huntr.dev Open in urlscan Pro
2600:9000:214f:9c00:14:bb32:5f00:93a1 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://huntr.dev/bounties/31ac0506-ae38-4128-a46d-71d5d079f8b7/
Submission: On September 21 via api (September 21st 2022, 7:54:53 pm UTC) from US — Scanned from DE

Summary HTTP 89 Redirects Links 16 Behaviour Indicators

Summary

This website contacted 16 IPs in 3 countries across 12 domains to perform 89 HTTP transactions. The main IP is 2600:9000:214f:9c00:14:bb32:5f00:93a1, located in United States and belongs to AMAZON-02, US. The main domain is huntr.dev.
TLS certificate: Issued by Amazon on January 26th 2022. Valid for: a year.

This is the only time huntr.dev was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 39	2600:9000:214... 2600:9000:214f:9c00:14:bb32:5f00:93a1	16509 (AMAZON-02) (AMAZON-02)
8	13.225.79.112 13.225.79.112	16509 (AMAZON-02) (AMAZON-02)
1 9	54.237.133.81 54.237.133.81	14618 (AMAZON-AES) (AMAZON-AES)
2	3.214.195.105 3.214.195.105	14618 (AMAZON-AES) (AMAZON-AES)
16	52.222.236.16 52.222.236.16	16509 (AMAZON-02) (AMAZON-02)
1	18.66.97.53 18.66.97.53	16509 (AMAZON-02) (AMAZON-02)
2	2a04:4e42:200... 2a04:4e42:200::729	54113 (FASTLY) (FASTLY)
1	52.11.123.128 52.11.123.128	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:800::2001	15169 (GOOGLE) (GOOGLE)
4	2600:9000:224... 2600:9000:2240:ea00:7:dce7:b680:21	16509 (AMAZON-02) (AMAZON-02)
1	52.222.236.43 52.222.236.43	16509 (AMAZON-02) (AMAZON-02)
1	65.9.44.23 65.9.44.23	16509 (AMAZON-02) (AMAZON-02)
1	52.30.157.40 52.30.157.40	16509 (AMAZON-02) (AMAZON-02)
3	2606:50c0:800... 2606:50c0:8002::154	54113 (FASTLY) (FASTLY)
1 1	140.82.121.3 140.82.121.3	36459 (GITHUB) (GITHUB)
1	54.231.204.161 54.231.204.161	16509 (AMAZON-02) (AMAZON-02)
89	16

39 2600:9000:214f:9c00:14:bb32:5f00:93a1 (United States) 1 redirects

ASN16509 (AMAZON-02, US)

huntr.dev	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 13.225.79.112 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-225-79-112.fra2.r.cloudfront.net

cdn.segment.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 54.237.133.81 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-237-133-81.compute-1.amazonaws.com

app.chatwoot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.214.195.105 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-214-195-105.compute-1.amazonaws.com

app.posthog.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

16 52.222.236.16 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-222-236-16.fra56.r.cloudfront.net

mnk2smepzzdp5djxpbthzr6odq.appsync-api.eu-west-1.amazonaws.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.66.97.53 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-97-53.fra56.r.cloudfront.net

static.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a04:4e42:200::729 (United States)

ASN54113 (FASTLY, US)

browser.sentry-cdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.11.123.128 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-11-123-128.us-west-2.compute.amazonaws.com

api.segment.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:800::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

lh3.googleusercontent.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2600:9000:2240:ea00:7:dce7:b680:21 (United States)

ASN16509 (AMAZON-02, US)

d3tq67kexc2w2i.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.222.236.43 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-222-236-43.fra56.r.cloudfront.net

script.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 65.9.44.23 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-65-9-44-23.arn54.r.cloudfront.net

vars.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.30.157.40 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-30-157-40.eu-west-1.compute.amazonaws.com

in.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2606:50c0:8002::154 (United States)

ASN54113 (FASTLY, US)

avatars.githubusercontent.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 140.82.121.3 (United States) 1 redirects

ASN36459 (GITHUB, US)
PTR: lb-140-82-121-3-fra.github.com

github.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.231.204.161 (Ashburn, United States)

ASN16509 (AMAZON-02, US)
PTR: s3-1-w.amazonaws.com

prod-chatwoot-assets.s3.amazonaws.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
39	huntr.dev 1 redirects huntr.dev	1 MB
17	amazonaws.com mnk2smepzzdp5djxpbthzr6odq.appsync-api.eu-west-1.amazonaws.com prod-chatwoot-assets.s3.amazonaws.com — Cisco Umbrella Rank: 913176	35 KB
9	chatwoot.com 1 redirects app.chatwoot.com — Cisco Umbrella Rank: 277366	39 KB
8	segment.com cdn.segment.com — Cisco Umbrella Rank: 1475	64 KB
4	cloudfront.net d3tq67kexc2w2i.cloudfront.net	189 KB
4	hotjar.com static.hotjar.com — Cisco Umbrella Rank: 591 script.hotjar.com — Cisco Umbrella Rank: 779 vars.hotjar.com — Cisco Umbrella Rank: 852 in.hotjar.com — Cisco Umbrella Rank: 1671 ws16.hotjar.com Failed	70 KB
3	githubusercontent.com avatars.githubusercontent.com — Cisco Umbrella Rank: 9005	58 KB
2	sentry-cdn.com browser.sentry-cdn.com — Cisco Umbrella Rank: 4241	19 KB
2	posthog.com app.posthog.com — Cisco Umbrella Rank: 36555	745 B
1	github.com 1 redirects github.com — Cisco Umbrella Rank: 3033	3 KB
1	googleusercontent.com lh3.googleusercontent.com — Cisco Umbrella Rank: 67	248 KB
1	segment.io api.segment.io — Cisco Umbrella Rank: 1011	170 B
89	12

	Domain	Requested by
39	huntr.dev	1 redirects huntr.dev
16	mnk2smepzzdp5djxpbthzr6odq.appsync-api.eu-west-1.amazonaws.com	huntr.dev browser.sentry-cdn.com
9	app.chatwoot.com	1 redirects huntr.dev app.chatwoot.com d3tq67kexc2w2i.cloudfront.net
8	cdn.segment.com	huntr.dev cdn.segment.com
4	d3tq67kexc2w2i.cloudfront.net	app.chatwoot.com d3tq67kexc2w2i.cloudfront.net
3	avatars.githubusercontent.com	huntr.dev
2	browser.sentry-cdn.com	cdn.segment.com
2	app.posthog.com	huntr.dev browser.sentry-cdn.com
1	prod-chatwoot-assets.s3.amazonaws.com
1	github.com	1 redirects
1	in.hotjar.com	browser.sentry-cdn.com
1	vars.hotjar.com	static.hotjar.com
1	script.hotjar.com	static.hotjar.com
1	lh3.googleusercontent.com	huntr.dev
1	api.segment.io	cdn.segment.com
1	static.hotjar.com	cdn.segment.com
0	ws16.hotjar.com Failed	browser.sentry-cdn.com
89	17

This site contains links to these domains. Also see Links.

Domain
github.com
www.github.com
nvd.nist.gov
cwe.mitre.org
twitter.com
www.youtube.com
linkedin.com
instagram.com
418sec.com
www.418sec.com

Subject Issuer	Validity	Valid
*.huntr.dev Amazon	`2022-01-26` - `2023-02-23`	a year	crt.sh
*.segment.com Amazon	`2022-01-12` - `2023-02-10`	a year	crt.sh
app.chatwoot.com R3	`2022-09-11` - `2022-12-10`	3 months	crt.sh
app.posthog.com Amazon	`2021-11-04` - `2022-12-02`	a year	crt.sh
*.appsync-api.eu-west-1.amazonaws.com Amazon	`2022-01-06` - `2023-02-04`	a year	crt.sh
*.hotjar.com Amazon	`2021-11-25` - `2022-12-23`	a year	crt.sh
*.sentry-cdn.com GlobalSign Atlas R3 DV TLS CA H2 2021	`2021-11-26` - `2022-12-28`	a year	crt.sh
*.segment.io Amazon	`2022-02-10` - `2023-03-11`	a year	crt.sh
*.googleusercontent.com GTS CA 1C3	`2022-09-05` - `2022-11-28`	3 months	crt.sh
*.cloudfront.net Amazon	`2022-02-01` - `2023-01-31`	a year	crt.sh
*.github.com DigiCert TLS RSA SHA256 2020 CA1	`2022-04-07` - `2023-04-07`	a year	crt.sh

This page contains 3 frames:

Primary Page: https://huntr.dev/bounties/31ac0506-ae38-4128-a46d-71d5d079f8b7/
Frame ID: 89B43E78B4118AF5011E7ACD6CC1064F
Requests: 69 HTTP requests in this frame

Frame: https://app.chatwoot.com/widget?website_token=puTnMCiAd9DHeNuoWk2mzm6X
Frame ID: 0446340ACA8F394E1D3F32783EE4E436
Requests: 12 HTTP requests in this frame

Frame: https://vars.hotjar.com/box-69edcc3187336f9b0a3fbb4c73be9fe6.html
Frame ID: B94B6A3E52722477ACB4AC72D5042039
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Stored Cross Site Scripting (XSS) via "properties" during creating new users vulnerability found in pimcore

Page URL History Show full URLs

https://huntr.dev/bounties/31ac0506-ae38-4128-a46d-71d5d079f8b7 HTTP 301
https://huntr.dev/bounties/31ac0506-ae38-4128-a46d-71d5d079f8b7/ Page URL

Detected technologies

Sentry (Issue Trackers) Expand

Overall confidence: 100%
Detected patterns

browser\.sentry\-cdn\.com/([0-9.]+)/bundle(?:\.tracing)?(?:\.min)?\.js

Nuxt.js (JavaScript Frameworks) Expand

Overall confidence: 100%
Detected patterns

/_nuxt/

Hotjar (Analytics) Expand

Overall confidence: 100%
Detected patterns

//static\.hotjar\.com/

Segment (Analytics) Expand

Overall confidence: 100%
Detected patterns

cdn\.segment\.com/analytics\.js

Page Statistics

89
Requests

97 %
HTTPS

31 %
IPv6

12
Domains

17
Subdomains

16
IPs

3
Countries

2039 kB
Transfer

5883 kB
Size

9
Cookies

16 Outgoing links

These are links going to different origins than the main page.

URL: https://github.com/pimcore/pimcore/blob/11.x/bundles/AdminBundle/Controller/Admin/UserController.php#L277-L385
Title: UserController.php L277-L385

Search URL Search Domain Scan URL

URL: https://github.com/pimcore/pimcore
Title: pimcore

Search URL Search Domain Scan URL

URL: https://www.github.com/pimcore/pimcore/commit/0508c491c6a4f3d119ec8dcf444e52ff25028c36
Title: 0508c4

Search URL Search Domain Scan URL

URL: https://nvd.nist.gov/vuln/detail/CVE-2022-3211
Title: CVE-2022-3211

Search URL Search Domain Scan URL

URL: https://cwe.mitre.org/data/definitions/79.html
Title: CWE-79: Cross-site Scripting (XSS) - Stored

Search URL Search Domain Scan URL

URL: https://github.com/saitamang

Search URL Search Domain Scan URL

URL: https://twitter.com/@mang_saitamang

Search URL Search Domain Scan URL

URL: https://github.com/dvesh3

Search URL Search Domain Scan URL

URL: https://github.com/418sec/huntr

Search URL Search Domain Scan URL

URL: https://twitter.com/huntrdev

Search URL Search Domain Scan URL

URL: https://www.youtube.com/channel/UC33YyLk3vdtnPqLeOuEZc2w

Search URL Search Domain Scan URL

URL: https://linkedin.com/company/huntrdev

Search URL Search Domain Scan URL

URL: https://instagram.com/huntr.dev

Search URL Search Domain Scan URL

URL: https://418sec.com/
Title: company

Search URL Search Domain Scan URL

URL: https://www.418sec.com/#about
Title: about

Search URL Search Domain Scan URL

URL: https://www.418sec.com/#team
Title: team

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://huntr.dev/bounties/31ac0506-ae38-4128-a46d-71d5d079f8b7 HTTP 301
https://huntr.dev/bounties/31ac0506-ae38-4128-a46d-71d5d079f8b7/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 83

https://github.com/pimcore.png HTTP 302
https://avatars.githubusercontent.com/u/686745?v=4

Request Chain 84

https://app.chatwoot.com/rails/active_storage/representations/redirect/eyJfcmFpbHMiOnsibWVzc2FnZSI6IkJBaHBBeWplRVE9PSIsImV4cCI6bnVsbCwicHVyIjoiYmxvYl9pZCJ9fQ==--6cb91ac7b4e48808e78a8d6ff61c52a99da0d564/eyJfcmFpbHMiOnsibWVzc2FnZSI6IkJBaDdCem9MWm05eWJXRjBTU0lJY0c1bkJqb0dSVlE2QzNKbGMybDZaVWtpRERJMU1IZ3lOVEFHT3daVSIsImV4cCI6bnVsbCwicHVyIjoidmFyaWF0aW9uIn19--0ebc19c01420fe8a8c6a202fcf9e63947dea59fd/New%20Project%20(16).png HTTP 302
https://prod-chatwoot-assets.s3.amazonaws.com/variants/2ll67w41cg1ugvvjj7lvmhtlw499/57496d59bd65461658f8699a5f17b76e76ea0b02ffb71890c8dbfe4064ba7e6e?response-content-disposition=inline%3B%20filename%3D%22New%20Project%20%252816%2529.png%22%3B%20filename%2A%3DUTF-8%27%27New%2520Project%2520%252816%2529.png&response-content-type=image%2Fpng&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAX7PDOLKIEKWPSDFO%2F20220921%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20220921T195449Z&X-Amz-Expires=300&X-Amz-SignedHeaders=host&X-Amz-Signature=200911c225e773d72a99431993718344fd4024b18d66bd251926a63616b22cc0

89 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

404

Primary Request / Show response
huntr.dev/bounties/31ac0506-ae38-4128-a46d-71d5d079f8b7/
Redirect Chain

https://huntr.dev/bounties/31ac0506-ae38-4128-a46d-71d5d079f8b7
https://huntr.dev/bounties/31ac0506-ae38-4128-a46d-71d5d079f8b7/

5 KB
2 KB

123ms
122ms

Document
text/html

2600:9000:214f:9c00:14:bb32:5f00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://huntr.dev/bounties/31ac0506-ae38-4128-a46d-71d5d079f8b7/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:214f:9c00:14:bb32:5f00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 5c967a3fbb481cac18f919f1015901f05276a976bb4f22e65b492f16e54631ad

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

content-encoding: gzip
content-type: text/html
date: Wed, 21 Sep 2022 19:54:46 GMT
server: AmazonS3
vary: Accept-Encoding
via: 1.1 a4a46c5a6cdf81ec1d08cf6e63389764.cloudfront.net (CloudFront)
x-amz-cf-id: E-mCB6DtyvikELhDNLMhsj73cdCJevxua62dYgX67vujBxm2V7Wyyg==
x-amz-cf-pop: FRA53-C1
x-cache: Error from cloudfront

Redirect headers

content-length: 0
content-type: application/xml
date: Wed, 21 Sep 2022 19:54:46 GMT
location: /bounties/31ac0506-ae38-4128-a46d-71d5d079f8b7/
server: AmazonS3
via: 1.1 a4a46c5a6cdf81ec1d08cf6e63389764.cloudfront.net (CloudFront)
x-amz-cf-id: DmbVEziJ17wVIObGQPCxalaz4n-XDiQOllTDQahJguJtw_NnSvVCew==
x-amz-cf-pop: FRA53-C1
x-cache: Error from cloudfront

GET
H2 200 2c71194.js Show response
huntr.dev/_nuxt/ 3 KB
3 KB 40ms
39ms Script
application/javascript 2600:9000:214f:9c00:14:bb32:5f00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://huntr.dev/_nuxt/2c71194.js

Requested by

Host: huntr.dev
URL: https://huntr.dev/bounties/31ac0506-ae38-4128-a46d-71d5d079f8b7/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:214f:9c00:14:bb32:5f00:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

56e3d9843ca444fd15ada7abb636eac771a4f1c88442215598042a2172eb2a64

Security Headers

Name	Value
Content-Security-Policy	style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://heapanalytics.com; connect-src 'self' https://cdn.segment.com https://.ingest.sentry.io https://.hotjar.com https://.hotjar.io https://.huntr.dev https://.appsync-api.eu-west-1.amazonaws.com https://api.github.com https://api.bloggify.net https://heapanalytics.com https://api.segment.io wss://.hotjar.com https://app.posthog.com https://app.chatwoot.com; script-src 'self' 'unsafe-inline' https://browser.sentry-cdn.com https://cdn.heapanalytics.com https://heapanalytics.com https://*.hotjar.com https://app.chatwoot.com https://cdn.segment.com; font-src 'self' data: https://fonts.gstatic.com; child-src blob: https://www.youtube.com https://app.chatwoot.com https://vars.hotjar.com https://www.podbean.com;
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://huntr.dev/bounties/31ac0506-ae38-4128-a46d-71d5d079f8b7/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Wed, 21 Sep 2022 19:44:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 588
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
vary: Accept-Encoding
x-xss-protection: 1; mode=block
last-modified: Tue, 13 Sep 2022 20:42:30 GMT
server: AmazonS3
x-frame-options: SAMEORIGIN
etag: W/"372b3b9a0e4365f38110af9874f71f1f"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript
via: 1.1 a4a46c5a6cdf81ec1d08cf6e63389764.cloudfront.net (CloudFront)
cache-control: public, max-age=0, s-maxage=600
content-security-policy: style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://heapanalytics.com; connect-src 'self' https://cdn.segment.com https://*.ingest.sentry.io https://*.hotjar.com https://*.hotjar.io https://*.huntr.dev https://*.appsync-api.eu-west-1.amazonaws.com https://api.github.com https://api.bloggify.net https://heapanalytics.com https://api.segment.io wss://*.hotjar.com https://app.posthog.com https://app.chatwoot.com; script-src 'self' 'unsafe-inline' https://browser.sentry-cdn.com https://cdn.heapanalytics.com https://heapanalytics.com https://*.hotjar.com https://app.chatwoot.com https://cdn.segment.com; font-src 'self' data: https://fonts.gstatic.com; child-src blob: https://www.youtube.com https://app.chatwoot.com https://vars.hotjar.com https://www.podbean.com;
x-amz-cf-pop: FRA53-C1
x-amz-cf-id: 2K6OadxkcmDatD9gqSTCoEji6uqP4l4HJsIYhNnA-XqRe95nZn501w==

GET
H2 200 041d0e7.js Show response
huntr.dev/_nuxt/ 314 KB
109 KB 46ms
45ms Script
application/javascript 2600:9000:214f:9c00:14:bb32:5f00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://huntr.dev/_nuxt/041d0e7.js

Requested by

Host: huntr.dev
URL: https://huntr.dev/bounties/31ac0506-ae38-4128-a46d-71d5d079f8b7/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:214f:9c00:14:bb32:5f00:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

f5ab0d45edae2aadc349fbaf547da2dd376e68c70edab2f778cfcbedd6b6b54c

Security Headers

Name	Value
Content-Security-Policy	style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://heapanalytics.com; connect-src 'self' https://cdn.segment.com https://.ingest.sentry.io https://.hotjar.com https://.hotjar.io https://.huntr.dev https://.appsync-api.eu-west-1.amazonaws.com https://api.github.com https://api.bloggify.net https://heapanalytics.com https://api.segment.io wss://.hotjar.com https://app.posthog.com https://app.chatwoot.com; script-src 'self' 'unsafe-inline' https://browser.sentry-cdn.com https://cdn.heapanalytics.com https://heapanalytics.com https://*.hotjar.com https://app.chatwoot.com https://cdn.segment.com; font-src 'self' data: https://fonts.gstatic.com; child-src blob: https://www.youtube.com https://app.chatwoot.com https://vars.hotjar.com https://www.podbean.com;
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://huntr.dev/bounties/31ac0506-ae38-4128-a46d-71d5d079f8b7/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Wed, 21 Sep 2022 19:44:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 588
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
vary: Accept-Encoding
x-xss-protection: 1; mode=block
last-modified: Tue, 13 Sep 2022 20:42:30 GMT
server: AmazonS3
x-frame-options: SAMEORIGIN
etag: W/"cd63c57f3da40857fbf8940cd4981156"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript
via: 1.1 a4a46c5a6cdf81ec1d08cf6e63389764.cloudfront.net (CloudFront)
cache-control: public, max-age=0, s-maxage=600
content-security-policy: style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://heapanalytics.com; connect-src 'self' https://cdn.segment.com https://*.ingest.sentry.io https://*.hotjar.com https://*.hotjar.io https://*.huntr.dev https://*.appsync-api.eu-west-1.amazonaws.com https://api.github.com https://api.bloggify.net https://heapanalytics.com https://api.segment.io wss://*.hotjar.com https://app.posthog.com https://app.chatwoot.com; script-src 'self' 'unsafe-inline' https://browser.sentry-cdn.com https://cdn.heapanalytics.com https://heapanalytics.com https://*.hotjar.com https://app.chatwoot.com https://cdn.segment.com; font-src 'self' data: https://fonts.gstatic.com; child-src blob: https://www.youtube.com https://app.chatwoot.com https://vars.hotjar.com https://www.podbean.com;
x-amz-cf-pop: FRA53-C1
x-amz-cf-id: lOZ1gSjPL_0czuAKBY3Iy5ef_hUaWfalIt03RWysWaH84FxhOnUFAQ==

GET
H2 200 06b2c2f.js Show response
huntr.dev/_nuxt/ 1 MB
302 KB 121ms
121ms Script
application/javascript 2600:9000:214f:9c00:14:bb32:5f00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://huntr.dev/_nuxt/06b2c2f.js

Requested by

Host: huntr.dev
URL: https://huntr.dev/bounties/31ac0506-ae38-4128-a46d-71d5d079f8b7/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:214f:9c00:14:bb32:5f00:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

c278fc2756f7d4a5d166505c54e0a6d7d825a969bd241e6454b60afdefe500e0

Security Headers

Name	Value
Content-Security-Policy	style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://heapanalytics.com; connect-src 'self' https://cdn.segment.com https://.ingest.sentry.io https://.hotjar.com https://.hotjar.io https://.huntr.dev https://.appsync-api.eu-west-1.amazonaws.com https://api.github.com https://api.bloggify.net https://heapanalytics.com https://api.segment.io wss://.hotjar.com https://app.posthog.com https://app.chatwoot.com; script-src 'self' 'unsafe-inline' https://browser.sentry-cdn.com https://cdn.heapanalytics.com https://heapanalytics.com https://*.hotjar.com https://app.chatwoot.com https://cdn.segment.com; font-src 'self' data: https://fonts.gstatic.com; child-src blob: https://www.youtube.com https://app.chatwoot.com https://vars.hotjar.com https://www.podbean.com;
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://huntr.dev/bounties/31ac0506-ae38-4128-a46d-71d5d079f8b7/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Wed, 21 Sep 2022 19:44:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 588
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
vary: Accept-Encoding
x-xss-protection: 1; mode=block
last-modified: Tue, 13 Sep 2022 20:42:30 GMT
server: AmazonS3
x-frame-options: SAMEORIGIN
etag: W/"da9a8c7a1018617be05366f03bb76967"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript
via: 1.1 a4a46c5a6cdf81ec1d08cf6e63389764.cloudfront.net (CloudFront)
cache-control: public, max-age=0, s-maxage=600
content-security-policy: style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://heapanalytics.com; connect-src 'self' https://cdn.segment.com https://*.ingest.sentry.io https://*.hotjar.com https://*.hotjar.io https://*.huntr.dev https://*.appsync-api.eu-west-1.amazonaws.com https://api.github.com https://api.bloggify.net https://heapanalytics.com https://api.segment.io wss://*.hotjar.com https://app.posthog.com https://app.chatwoot.com; script-src 'self' 'unsafe-inline' https://browser.sentry-cdn.com https://cdn.heapanalytics.com https://heapanalytics.com https://*.hotjar.com https://app.chatwoot.com https://cdn.segment.com; font-src 'self' data: https://fonts.gstatic.com; child-src blob: https://www.youtube.com https://app.chatwoot.com https://vars.hotjar.com https://www.podbean.com;
x-amz-cf-pop: FRA53-C1
x-amz-cf-id: HcFWQSx6rp7Rj0v9jKmLuyI-NANfh_f84UDivDjFWMp4WiVsDDnSUQ==

GET
H2 200 dd352c8.js Show response
huntr.dev/_nuxt/ 74 KB
16 KB 165ms
165ms Script
application/javascript 2600:9000:214f:9c00:14:bb32:5f00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://huntr.dev/_nuxt/dd352c8.js

Requested by

Host: huntr.dev
URL: https://huntr.dev/bounties/31ac0506-ae38-4128-a46d-71d5d079f8b7/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:214f:9c00:14:bb32:5f00:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

b49647ca17935cfd8f4b81ace833d4ac41bed83aefa112a5f5e06dec1755f8ab

Security Headers

Name	Value
Content-Security-Policy	style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://heapanalytics.com; connect-src 'self' https://cdn.segment.com https://.ingest.sentry.io https://.hotjar.com https://.hotjar.io https://.huntr.dev https://.appsync-api.eu-west-1.amazonaws.com https://api.github.com https://api.bloggify.net https://heapanalytics.com https://api.segment.io wss://.hotjar.com https://app.posthog.com https://app.chatwoot.com; script-src 'self' 'unsafe-inline' https://browser.sentry-cdn.com https://cdn.heapanalytics.com https://heapanalytics.com https://*.hotjar.com https://app.chatwoot.com https://cdn.segment.com; font-src 'self' data: https://fonts.gstatic.com; child-src blob: https://www.youtube.com https://app.chatwoot.com https://vars.hotjar.com https://www.podbean.com;
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://huntr.dev/bounties/31ac0506-ae38-4128-a46d-71d5d079f8b7/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Wed, 21 Sep 2022 19:44:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 588
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
vary: Accept-Encoding
x-xss-protection: 1; mode=block
last-modified: Tue, 13 Sep 2022 20:42:30 GMT
server: AmazonS3
x-frame-options: SAMEORIGIN
etag: W/"b1c08becba69db2d4e35e171d0fc665f"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript
via: 1.1 a4a46c5a6cdf81ec1d08cf6e63389764.cloudfront.net (CloudFront)
cache-control: public, max-age=0, s-maxage=600
content-security-policy: style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://heapanalytics.com; connect-src 'self' https://cdn.segment.com https://*.ingest.sentry.io https://*.hotjar.com https://*.hotjar.io https://*.huntr.dev https://*.appsync-api.eu-west-1.amazonaws.com https://api.github.com https://api.bloggify.net https://heapanalytics.com https://api.segment.io wss://*.hotjar.com https://app.posthog.com https://app.chatwoot.com; script-src 'self' 'unsafe-inline' https://browser.sentry-cdn.com https://cdn.heapanalytics.com https://heapanalytics.com https://*.hotjar.com https://app.chatwoot.com https://cdn.segment.com; font-src 'self' data: https://fonts.gstatic.com; child-src blob: https://www.youtube.com https://app.chatwoot.com https://vars.hotjar.com https://www.podbean.com;
x-amz-cf-pop: FRA53-C1
x-amz-cf-id: DHj50uuihOlqqSEUgKBRbODZfTNHwOtcFt55HPn1Zs811Kup4oGm8w==

GET
H2 200 bbb917f.js Show response
huntr.dev/_nuxt/ 66 KB
19 KB 39ms
39ms Script
application/javascript 2600:9000:214f:9c00:14:bb32:5f00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://huntr.dev/_nuxt/bbb917f.js

Requested by

Host: huntr.dev
URL: https://huntr.dev/_nuxt/2c71194.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:214f:9c00:14:bb32:5f00:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

e82c376465bde839192944cece9d23d0c39d2ddb7523212b4a809355f15efb59

Security Headers

Name	Value
Content-Security-Policy	style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://heapanalytics.com; connect-src 'self' https://cdn.segment.com https://.ingest.sentry.io https://.hotjar.com https://.hotjar.io https://.huntr.dev https://.appsync-api.eu-west-1.amazonaws.com https://api.github.com https://api.bloggify.net https://heapanalytics.com https://api.segment.io wss://.hotjar.com https://app.posthog.com https://app.chatwoot.com; script-src 'self' 'unsafe-inline' https://browser.sentry-cdn.com https://cdn.heapanalytics.com https://heapanalytics.com https://*.hotjar.com https://app.chatwoot.com https://cdn.segment.com; font-src 'self' data: https://fonts.gstatic.com; child-src blob: https://www.youtube.com https://app.chatwoot.com https://vars.hotjar.com https://www.podbean.com;
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://huntr.dev/bounties/31ac0506-ae38-4128-a46d-71d5d079f8b7/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Wed, 21 Sep 2022 19:44:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 589
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
vary: Accept-Encoding
x-xss-protection: 1; mode=block
last-modified: Tue, 13 Sep 2022 20:42:30 GMT
server: AmazonS3
x-frame-options: SAMEORIGIN
etag: W/"be4dba135aeb7cf8e26a4cdd1d35986c"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript
via: 1.1 a4a46c5a6cdf81ec1d08cf6e63389764.cloudfront.net (CloudFront)
cache-control: public, max-age=0, s-maxage=600
content-security-policy: style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://heapanalytics.com; connect-src 'self' https://cdn.segment.com https://*.ingest.sentry.io https://*.hotjar.com https://*.hotjar.io https://*.huntr.dev https://*.appsync-api.eu-west-1.amazonaws.com https://api.github.com https://api.bloggify.net https://heapanalytics.com https://api.segment.io wss://*.hotjar.com https://app.posthog.com https://app.chatwoot.com; script-src 'self' 'unsafe-inline' https://browser.sentry-cdn.com https://cdn.heapanalytics.com https://heapanalytics.com https://*.hotjar.com https://app.chatwoot.com https://cdn.segment.com; font-src 'self' data: https://fonts.gstatic.com; child-src blob: https://www.youtube.com https://app.chatwoot.com https://vars.hotjar.com https://www.podbean.com;
x-amz-cf-pop: FRA53-C1
x-amz-cf-id: O3BPQhsQmWHAqdew6If8NECV_QUWFG4rYLdFIEhq1oIF8eJ2tRvWHQ==

GET
H2 200 7d13b10.js Show response
huntr.dev/_nuxt/ 68 KB
15 KB 40ms
40ms Script
application/javascript 2600:9000:214f:9c00:14:bb32:5f00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://huntr.dev/_nuxt/7d13b10.js

Requested by

Host: huntr.dev
URL: https://huntr.dev/_nuxt/2c71194.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:214f:9c00:14:bb32:5f00:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

0c6cece955685c5ff23f4c7ffef013bef3313e5bd3b7938f8acc49e49e5dbcbd

Security Headers

Name	Value
Content-Security-Policy	style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://heapanalytics.com; connect-src 'self' https://cdn.segment.com https://.ingest.sentry.io https://.hotjar.com https://.hotjar.io https://.huntr.dev https://.appsync-api.eu-west-1.amazonaws.com https://api.github.com https://api.bloggify.net https://heapanalytics.com https://api.segment.io wss://.hotjar.com https://app.posthog.com https://app.chatwoot.com; script-src 'self' 'unsafe-inline' https://browser.sentry-cdn.com https://cdn.heapanalytics.com https://heapanalytics.com https://*.hotjar.com https://app.chatwoot.com https://cdn.segment.com; font-src 'self' data: https://fonts.gstatic.com; child-src blob: https://www.youtube.com https://app.chatwoot.com https://vars.hotjar.com https://www.podbean.com;
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://huntr.dev/bounties/31ac0506-ae38-4128-a46d-71d5d079f8b7/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Wed, 21 Sep 2022 19:44:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 589
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
vary: Accept-Encoding
x-xss-protection: 1; mode=block
last-modified: Tue, 13 Sep 2022 20:42:30 GMT
server: AmazonS3
x-frame-options: SAMEORIGIN
etag: W/"f673a75cf5f54fd09f3c3102a4ad979c"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript
via: 1.1 a4a46c5a6cdf81ec1d08cf6e63389764.cloudfront.net (CloudFront)
cache-control: public, max-age=0, s-maxage=600
content-security-policy: style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://heapanalytics.com; connect-src 'self' https://cdn.segment.com https://*.ingest.sentry.io https://*.hotjar.com https://*.hotjar.io https://*.huntr.dev https://*.appsync-api.eu-west-1.amazonaws.com https://api.github.com https://api.bloggify.net https://heapanalytics.com https://api.segment.io wss://*.hotjar.com https://app.posthog.com https://app.chatwoot.com; script-src 'self' 'unsafe-inline' https://browser.sentry-cdn.com https://cdn.heapanalytics.com https://heapanalytics.com https://*.hotjar.com https://app.chatwoot.com https://cdn.segment.com; font-src 'self' data: https://fonts.gstatic.com; child-src blob: https://www.youtube.com https://app.chatwoot.com https://vars.hotjar.com https://www.podbean.com;
x-amz-cf-pop: FRA53-C1
x-amz-cf-id: gPzqppA6jVLLUNZvBtxkt-lixAy_PaAb_zFSq4y0YabN9oGu5wCeXA==

GET
H2 200 faf5d44.js Show response
huntr.dev/_nuxt/ 863 KB
273 KB 41ms
41ms Script
application/javascript 2600:9000:214f:9c00:14:bb32:5f00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://huntr.dev/_nuxt/faf5d44.js

Requested by

Host: huntr.dev
URL: https://huntr.dev/_nuxt/2c71194.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:214f:9c00:14:bb32:5f00:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

fe53a0e8f9c1c6c61aee80e0605b431396992f57cc205d3f79eeff76dd2dbbb7

Security Headers

Name	Value
Content-Security-Policy	style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://heapanalytics.com; connect-src 'self' https://cdn.segment.com https://.ingest.sentry.io https://.hotjar.com https://.hotjar.io https://.huntr.dev https://.appsync-api.eu-west-1.amazonaws.com https://api.github.com https://api.bloggify.net https://heapanalytics.com https://api.segment.io wss://.hotjar.com https://app.posthog.com https://app.chatwoot.com; script-src 'self' 'unsafe-inline' https://browser.sentry-cdn.com https://cdn.heapanalytics.com https://heapanalytics.com https://*.hotjar.com https://app.chatwoot.com https://cdn.segment.com; font-src 'self' data: https://fonts.gstatic.com; child-src blob: https://www.youtube.com https://app.chatwoot.com https://vars.hotjar.com https://www.podbean.com;
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://huntr.dev/bounties/31ac0506-ae38-4128-a46d-71d5d079f8b7/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Wed, 21 Sep 2022 19:44:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 589
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
vary: Accept-Encoding
x-xss-protection: 1; mode=block
last-modified: Tue, 13 Sep 2022 20:42:30 GMT
server: AmazonS3
x-frame-options: SAMEORIGIN
etag: W/"046845c1f4b3e08ec6c8030a12a0d5a9"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript
via: 1.1 a4a46c5a6cdf81ec1d08cf6e63389764.cloudfront.net (CloudFront)
cache-control: public, max-age=0, s-maxage=600
content-security-policy: style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://heapanalytics.com; connect-src 'self' https://cdn.segment.com https://*.ingest.sentry.io https://*.hotjar.com https://*.hotjar.io https://*.huntr.dev https://*.appsync-api.eu-west-1.amazonaws.com https://api.github.com https://api.bloggify.net https://heapanalytics.com https://api.segment.io wss://*.hotjar.com https://app.posthog.com https://app.chatwoot.com; script-src 'self' 'unsafe-inline' https://browser.sentry-cdn.com https://cdn.heapanalytics.com https://heapanalytics.com https://*.hotjar.com https://app.chatwoot.com https://cdn.segment.com; font-src 'self' data: https://fonts.gstatic.com; child-src blob: https://www.youtube.com https://app.chatwoot.com https://vars.hotjar.com https://www.podbean.com;
x-amz-cf-pop: FRA53-C1
x-amz-cf-id: e4njSFtHq3CPj23lKQWr7-Y8yPmbMns6n7E6bVizKiOwco-_0cMcnQ==

GET
H2 200 b7b49a3.js Show response
huntr.dev/_nuxt/ 54 KB
17 KB 57ms
57ms Script
application/javascript 2600:9000:214f:9c00:14:bb32:5f00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://huntr.dev/_nuxt/b7b49a3.js

Requested by

Host: huntr.dev
URL: https://huntr.dev/_nuxt/2c71194.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:214f:9c00:14:bb32:5f00:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

752691a5f3544604fa4e0c630d7bd1dd4077bc34d94ed60b1e17ca2c89f9d084

Security Headers

Name	Value
Content-Security-Policy	style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://heapanalytics.com; connect-src 'self' https://cdn.segment.com https://.ingest.sentry.io https://.hotjar.com https://.hotjar.io https://.huntr.dev https://.appsync-api.eu-west-1.amazonaws.com https://api.github.com https://api.bloggify.net https://heapanalytics.com https://api.segment.io wss://.hotjar.com https://app.posthog.com https://app.chatwoot.com; script-src 'self' 'unsafe-inline' https://browser.sentry-cdn.com https://cdn.heapanalytics.com https://heapanalytics.com https://*.hotjar.com https://app.chatwoot.com https://cdn.segment.com; font-src 'self' data: https://fonts.gstatic.com; child-src blob: https://www.youtube.com https://app.chatwoot.com https://vars.hotjar.com https://www.podbean.com;
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://huntr.dev/bounties/31ac0506-ae38-4128-a46d-71d5d079f8b7/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Wed, 21 Sep 2022 19:44:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 589
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
vary: Accept-Encoding
x-xss-protection: 1; mode=block
last-modified: Tue, 13 Sep 2022 20:42:30 GMT
server: AmazonS3
x-frame-options: SAMEORIGIN
etag: W/"509c72d49b58c4c7d573dda79a3eba5b"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript
via: 1.1 a4a46c5a6cdf81ec1d08cf6e63389764.cloudfront.net (CloudFront)
cache-control: public, max-age=0, s-maxage=600
content-security-policy: style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://heapanalytics.com; connect-src 'self' https://cdn.segment.com https://*.ingest.sentry.io https://*.hotjar.com https://*.hotjar.io https://*.huntr.dev https://*.appsync-api.eu-west-1.amazonaws.com https://api.github.com https://api.bloggify.net https://heapanalytics.com https://api.segment.io wss://*.hotjar.com https://app.posthog.com https://app.chatwoot.com; script-src 'self' 'unsafe-inline' https://browser.sentry-cdn.com https://cdn.heapanalytics.com https://heapanalytics.com https://*.hotjar.com https://app.chatwoot.com https://cdn.segment.com; font-src 'self' data: https://fonts.gstatic.com; child-src blob: https://www.youtube.com https://app.chatwoot.com https://vars.hotjar.com https://www.podbean.com;
x-amz-cf-pop: FRA53-C1
x-amz-cf-id: -Z02t0Ram6V4W53p48ykFsh3imJmGyRU4gL5dK0yE8bQBeGYTiKzUA==

GET
H2 200 202592b.js Show response
huntr.dev/_nuxt/ 419 KB
103 KB 59ms
58ms Script
application/javascript 2600:9000:214f:9c00:14:bb32:5f00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://huntr.dev/_nuxt/202592b.js

Requested by

Host: huntr.dev
URL: https://huntr.dev/_nuxt/2c71194.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:214f:9c00:14:bb32:5f00:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

740720449f552eee79a5599ce23d81cf4d0ba7d9f71941c65903fe21b82e1e0e

Security Headers

Name	Value
Content-Security-Policy	style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://heapanalytics.com; connect-src 'self' https://cdn.segment.com https://.ingest.sentry.io https://.hotjar.com https://.hotjar.io https://.huntr.dev https://.appsync-api.eu-west-1.amazonaws.com https://api.github.com https://api.bloggify.net https://heapanalytics.com https://api.segment.io wss://.hotjar.com https://app.posthog.com https://app.chatwoot.com; script-src 'self' 'unsafe-inline' https://browser.sentry-cdn.com https://cdn.heapanalytics.com https://heapanalytics.com https://*.hotjar.com https://app.chatwoot.com https://cdn.segment.com; font-src 'self' data: https://fonts.gstatic.com; child-src blob: https://www.youtube.com https://app.chatwoot.com https://vars.hotjar.com https://www.podbean.com;
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://huntr.dev/bounties/31ac0506-ae38-4128-a46d-71d5d079f8b7/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Wed, 21 Sep 2022 19:44:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 589
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
vary: Accept-Encoding
x-xss-protection: 1; mode=block
last-modified: Tue, 13 Sep 2022 20:42:30 GMT
server: AmazonS3
x-frame-options: SAMEORIGIN
etag: W/"8256d16bf6632b72365e35885f1d29e1"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript
via: 1.1 a4a46c5a6cdf81ec1d08cf6e63389764.cloudfront.net (CloudFront)
cache-control: public, max-age=0, s-maxage=600
content-security-policy: style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://heapanalytics.com; connect-src 'self' https://cdn.segment.com https://*.ingest.sentry.io https://*.hotjar.com https://*.hotjar.io https://*.huntr.dev https://*.appsync-api.eu-west-1.amazonaws.com https://api.github.com https://api.bloggify.net https://heapanalytics.com https://api.segment.io wss://*.hotjar.com https://app.posthog.com https://app.chatwoot.com; script-src 'self' 'unsafe-inline' https://browser.sentry-cdn.com https://cdn.heapanalytics.com https://heapanalytics.com https://*.hotjar.com https://app.chatwoot.com https://cdn.segment.com; font-src 'self' data: https://fonts.gstatic.com; child-src blob: https://www.youtube.com https://app.chatwoot.com https://vars.hotjar.com https://www.podbean.com;
x-amz-cf-pop: FRA53-C1
x-amz-cf-id: sxLHYv3edEZlZYIavVKd2equlNK2CLcAdBR1leUPdAg0imU-eNHHpQ==

GET
H2 200 analytics.min.js Show response
cdn.segment.com/analytics.js/v1/VWwEgATDMwku1jvgt0soCRaORr8xbOyx/ 96 KB
26 KB 192ms
45ms Script
text/javascript 13.225.79.112
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.segment.com/analytics.js/v1/VWwEgATDMwku1jvgt0soCRaORr8xbOyx/analytics.min.js
Requested by: Host: huntr.dev
URL: https://huntr.dev/_nuxt/06b2c2f.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.79.112 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-79-112.fra2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: a6a28dc168304608065bebf2920b473ceda58ce5e249087e4cfd00e37069617c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://huntr.dev/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

x-amz-version-id: z5G0zO.X9skgR0hbh6ZsyI38vBDxN8GH
content-encoding: br
etag: W/"3eb96cbd10c2c37acf8cce92e84cb87e"
age: 48
x-cache: Hit from cloudfront
access-control-max-age: 3000
x-amz-replication-status: COMPLETED
access-control-allow-origin: *
last-modified: Wed, 31 Aug 2022 20:58:47 GMT
server: AmazonS3
date: Wed, 21 Sep 2022 19:54:47 GMT
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: text/javascript; charset=utf-8
via: 1.1 edfd22ec6695cdc9d7ac634220af1314.cloudfront.net (CloudFront)
cache-control: public, max-age=120
x-amz-cf-pop: FRA2-C2
x-amz-cf-id: jNEIRcR33do8CRyV1WbNHz0JcG3sdoTL-_ARjsEpQreVh7LET32mOw==

GET
H/1.1 200
OK sdk.js Show response
app.chatwoot.com/packs/js/ 81 KB
25 KB 424ms
133ms Script
application/javascript 54.237.133.81
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://app.chatwoot.com/packs/js/sdk.js

Requested by

Host: huntr.dev
URL: https://huntr.dev/_nuxt/dd352c8.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

54.237.133.81 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-237-133-81.compute-1.amazonaws.com

Software

Cowboy /

Resource Hash

78420a011bbebafa356ef0a6d45fee785af8cc117f1c118953efe652edd4066c

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://huntr.dev/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

Date: Wed, 21 Sep 2022 19:54:46 GMT
Content-Encoding: br
Last-Modified: Wed, 21 Sep 2022 01:31:48 GMT
Server: Cowboy
Vary: Accept-Encoding, Origin
Connection: keep-alive
Content-Type: application/javascript
Via: 1.1 vegur
Cache-Control: public, max-age=31556952
Strict-Transport-Security: max-age=63072000; includeSubDomains
Content-Length: 25257

POST
H2 200 / Show response
app.posthog.com/decide/ 193 B
452 B 438ms
138ms XHR
application/json 3.214.195.105
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://app.posthog.com/decide/?v=2&ip=1&_=1663790087131

Requested by

Host: huntr.dev
URL: https://huntr.dev/_nuxt/06b2c2f.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.214.195.105 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-214-195-105.compute-1.amazonaws.com

Software

Resource Hash

bffad81246e13f89b8aff1aa4415ff0cd6d7ec01aec2a19e740a48e64fd5cf1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://huntr.dev/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Wed, 21 Sep 2022 19:54:47 GMT
referrer-policy: same-origin
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/json
access-control-allow-origin: https://huntr.dev
access-control-allow-credentials: true
access-control-allow-headers: X-Requested-With,Content-Type
x-content-type-options: nosniff

POST
H2 200 graphql Show response
mnk2smepzzdp5djxpbthzr6odq.appsync-api.eu-west-1.amazonaws.com/ 4 KB
2 KB 374ms
373ms XHR
application/json 52.222.236.16
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://mnk2smepzzdp5djxpbthzr6odq.appsync-api.eu-west-1.amazonaws.com/graphql
Requested by: Host: huntr.dev
URL: https://huntr.dev/_nuxt/06b2c2f.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.236.16 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-236-16.fra56.r.cloudfront.net
Software: /
Resource Hash: 38d343434c38de27774371d949ef2d53cf0ffb068c8ffe315fdec978ca6e1de4

Request headers

accept: */*
Referer: https://huntr.dev/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36
x-api-key: da2-fql7xoajcng6pilmew4lfbi6ga
content-type: application/json

Response headers

x-amzn-appsync-tokensconsumed: 4
date: Wed, 21 Sep 2022 19:54:47 GMT
content-encoding: gzip
x-amz-cf-pop: FRA56-P4
x-amzn-requestid: 861df76d-94e3-411b-aca4-a44a77262ec4
vary: Accept-Encoding
x-cache: Miss from cloudfront
content-type: application/json;charset=UTF-8
access-control-allow-origin: *
access-control-expose-headers: x-amzn-RequestId,x-amzn-ErrorType,x-amz-user-agent,x-amzn-ErrorMessage,Date,x-amz-schema-version
x-amz-cf-id: yVc9OIYAH9aps1kZzDYTIMnsK5lsqAuC-DzjhYA2sm1QLRJ-UnHq4g==
via: 1.1 ce765e91525a836efb6bc0a409334a5e.cloudfront.net (CloudFront)

OPTIONS
H2 200 graphql
mnk2smepzzdp5djxpbthzr6odq.appsync-api.eu-west-1.amazonaws.com/ Frame 0
0 268ms
151ms Preflight 52.222.236.16
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://mnk2smepzzdp5djxpbthzr6odq.appsync-api.eu-west-1.amazonaws.com/graphql
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.236.16 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-236-16.fra56.r.cloudfront.net
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type,x-api-key
Access-Control-Request-Method: POST
Origin: https://huntr.dev
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

access-control-allow-headers: content-type,x-api-key
access-control-allow-methods: POST
access-control-allow-origin: *
access-control-expose-headers: x-amzn-RequestId,x-amzn-ErrorType,x-amz-user-agent,x-amzn-ErrorMessage,Date,x-amz-schema-version
access-control-max-age: 172800
content-length: 0
date: Wed, 21 Sep 2022 19:54:47 GMT
via: 1.1 ce765e91525a836efb6bc0a409334a5e.cloudfront.net (CloudFront)
x-amz-cf-id: vcNYIj7FVeA3Yy5Qp_KCV93g7OKAKptaWmKM5cjF2r_JIJXSpbvIhQ==
x-amz-cf-pop: FRA56-P4
x-amzn-requestid: 9cea5bd4-a5c5-462b-80d9-725fde764211
x-cache: Miss from cloudfront

GET
H2 200 Montserrat-Regular.3cd7866.ttf
huntr.dev/_nuxt/fonts/ 240 KB
111 KB 115ms
114ms Font
font/ttf 2600:9000:214f:9c00:14:bb32:5f00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://huntr.dev/_nuxt/fonts/Montserrat-Regular.3cd7866.ttf

Requested by

Host: huntr.dev
URL: https://huntr.dev/bounties/31ac0506-ae38-4128-a46d-71d5d079f8b7/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:214f:9c00:14:bb32:5f00:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

077cdab15161232a9ba7124d2ddd7a9425145750788e9a966c156cc66274f525

Security Headers

Name	Value
Content-Security-Policy	style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://heapanalytics.com; connect-src 'self' https://cdn.segment.com https://.ingest.sentry.io https://.hotjar.com https://.hotjar.io https://.huntr.dev https://.appsync-api.eu-west-1.amazonaws.com https://api.github.com https://api.bloggify.net https://heapanalytics.com https://api.segment.io wss://.hotjar.com https://app.posthog.com https://app.chatwoot.com; script-src 'self' 'unsafe-inline' https://browser.sentry-cdn.com https://cdn.heapanalytics.com https://heapanalytics.com https://*.hotjar.com https://app.chatwoot.com https://cdn.segment.com; font-src 'self' data: https://fonts.gstatic.com; child-src blob: https://www.youtube.com https://app.chatwoot.com https://vars.hotjar.com https://www.podbean.com;
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://huntr.dev/bounties/31ac0506-ae38-4128-a46d-71d5d079f8b7/
Origin: https://huntr.dev
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Wed, 21 Sep 2022 19:54:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-amz-cf-pop: FRA53-C1
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
vary: Accept-Encoding
x-xss-protection: 1; mode=block
last-modified: Tue, 13 Sep 2022 20:42:30 GMT
server: AmazonS3
x-frame-options: SAMEORIGIN
etag: W/"ee6539921d713482b8ccd4d0d23961bb"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: font/ttf
via: 1.1 a4a46c5a6cdf81ec1d08cf6e63389764.cloudfront.net (CloudFront)
cache-control: public, max-age=0, s-maxage=600
content-security-policy: style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://heapanalytics.com; connect-src 'self' https://cdn.segment.com https://*.ingest.sentry.io https://*.hotjar.com https://*.hotjar.io https://*.huntr.dev https://*.appsync-api.eu-west-1.amazonaws.com https://api.github.com https://api.bloggify.net https://heapanalytics.com https://api.segment.io wss://*.hotjar.com https://app.posthog.com https://app.chatwoot.com; script-src 'self' 'unsafe-inline' https://browser.sentry-cdn.com https://cdn.heapanalytics.com https://heapanalytics.com https://*.hotjar.com https://app.chatwoot.com https://cdn.segment.com; font-src 'self' data: https://fonts.gstatic.com; child-src blob: https://www.youtube.com https://app.chatwoot.com https://vars.hotjar.com https://www.podbean.com;
x-amz-cf-id: r3TwfmE_ZiiF70FOjWUcXMGaR6C-KcMOueZCzyPJQ_3_1ebRA-RDHw==

GET
H2 200 Montserrat-Medium.e2d60bc.ttf
huntr.dev/_nuxt/fonts/ 237 KB
111 KB 140ms
140ms Font
font/ttf 2600:9000:214f:9c00:14:bb32:5f00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://huntr.dev/_nuxt/fonts/Montserrat-Medium.e2d60bc.ttf

Requested by

Host: huntr.dev
URL: https://huntr.dev/bounties/31ac0506-ae38-4128-a46d-71d5d079f8b7/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:214f:9c00:14:bb32:5f00:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

421f26b23e2be6b98373d32acd3cb2897b154d4bf0a77d26534ce476e4cbed53

Security Headers

Name	Value
Content-Security-Policy	style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://heapanalytics.com; connect-src 'self' https://cdn.segment.com https://.ingest.sentry.io https://.hotjar.com https://.hotjar.io https://.huntr.dev https://.appsync-api.eu-west-1.amazonaws.com https://api.github.com https://api.bloggify.net https://heapanalytics.com https://api.segment.io wss://.hotjar.com https://app.posthog.com https://app.chatwoot.com; script-src 'self' 'unsafe-inline' https://browser.sentry-cdn.com https://cdn.heapanalytics.com https://heapanalytics.com https://*.hotjar.com https://app.chatwoot.com https://cdn.segment.com; font-src 'self' data: https://fonts.gstatic.com; child-src blob: https://www.youtube.com https://app.chatwoot.com https://vars.hotjar.com https://www.podbean.com;
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://huntr.dev/bounties/31ac0506-ae38-4128-a46d-71d5d079f8b7/
Origin: https://huntr.dev
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Wed, 21 Sep 2022 19:54:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-amz-cf-pop: FRA53-C1
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
vary: Accept-Encoding
x-xss-protection: 1; mode=block
last-modified: Tue, 13 Sep 2022 20:42:30 GMT
server: AmazonS3
x-frame-options: SAMEORIGIN
etag: W/"c8b6e083af3f94009801989c3739425e"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: font/ttf
via: 1.1 a4a46c5a6cdf81ec1d08cf6e63389764.cloudfront.net (CloudFront)
cache-control: public, max-age=0, s-maxage=600
content-security-policy: style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://heapanalytics.com; connect-src 'self' https://cdn.segment.com https://*.ingest.sentry.io https://*.hotjar.com https://*.hotjar.io https://*.huntr.dev https://*.appsync-api.eu-west-1.amazonaws.com https://api.github.com https://api.bloggify.net https://heapanalytics.com https://api.segment.io wss://*.hotjar.com https://app.posthog.com https://app.chatwoot.com; script-src 'self' 'unsafe-inline' https://browser.sentry-cdn.com https://cdn.heapanalytics.com https://heapanalytics.com https://*.hotjar.com https://app.chatwoot.com https://cdn.segment.com; font-src 'self' data: https://fonts.gstatic.com; child-src blob: https://www.youtube.com https://app.chatwoot.com https://vars.hotjar.com https://www.podbean.com;
x-amz-cf-id: _7ZdrKjvyYwQsK-seWjX9O_RNyp-gJD69mqRUkNxy7-IwDbcauxWtQ==

GET
H2 200 64789c0.js Show response
huntr.dev/_nuxt/ 33 KB
8 KB 106ms
105ms Script
application/javascript 2600:9000:214f:9c00:14:bb32:5f00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://huntr.dev/_nuxt/64789c0.js

Requested by

Host: huntr.dev
URL: https://huntr.dev/_nuxt/2c71194.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:214f:9c00:14:bb32:5f00:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

a2d3f0a59da3ade1b5ba72f112bd793ff7d874ad9450bebd3c2f4f8703474ebb

Security Headers

Name	Value
Content-Security-Policy	style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://heapanalytics.com; connect-src 'self' https://cdn.segment.com https://.ingest.sentry.io https://.hotjar.com https://.hotjar.io https://.huntr.dev https://.appsync-api.eu-west-1.amazonaws.com https://api.github.com https://api.bloggify.net https://heapanalytics.com https://api.segment.io wss://.hotjar.com https://app.posthog.com https://app.chatwoot.com; script-src 'self' 'unsafe-inline' https://browser.sentry-cdn.com https://cdn.heapanalytics.com https://heapanalytics.com https://*.hotjar.com https://app.chatwoot.com https://cdn.segment.com; font-src 'self' data: https://fonts.gstatic.com; child-src blob: https://www.youtube.com https://app.chatwoot.com https://vars.hotjar.com https://www.podbean.com;
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://huntr.dev/bounties/31ac0506-ae38-4128-a46d-71d5d079f8b7/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Wed, 21 Sep 2022 19:54:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-amz-cf-pop: FRA53-C1
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
vary: Accept-Encoding
x-xss-protection: 1; mode=block
last-modified: Tue, 13 Sep 2022 20:42:30 GMT
server: AmazonS3
x-frame-options: SAMEORIGIN
etag: W/"41af3c9ebe263d8f1d041bd90ae461f9"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript
via: 1.1 a4a46c5a6cdf81ec1d08cf6e63389764.cloudfront.net (CloudFront)
cache-control: public, max-age=0, s-maxage=600
content-security-policy: style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://heapanalytics.com; connect-src 'self' https://cdn.segment.com https://*.ingest.sentry.io https://*.hotjar.com https://*.hotjar.io https://*.huntr.dev https://*.appsync-api.eu-west-1.amazonaws.com https://api.github.com https://api.bloggify.net https://heapanalytics.com https://api.segment.io wss://*.hotjar.com https://app.posthog.com https://app.chatwoot.com; script-src 'self' 'unsafe-inline' https://browser.sentry-cdn.com https://cdn.heapanalytics.com https://heapanalytics.com https://*.hotjar.com https://app.chatwoot.com https://cdn.segment.com; font-src 'self' data: https://fonts.gstatic.com; child-src blob: https://www.youtube.com https://app.chatwoot.com https://vars.hotjar.com https://www.podbean.com;
x-amz-cf-id: OL0p6PrHc8BO42nbtzvhlouz8EeTE3L7VvNomcvnBDOy4AXvQJz5lw==

GET
H2 200 manifest.js Show response
huntr.dev/_nuxt/static/1663100578/ 156 KB
56 KB 135ms
134ms Script
application/javascript 2600:9000:214f:9c00:14:bb32:5f00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://huntr.dev/_nuxt/static/1663100578/manifest.js

Requested by

Host: huntr.dev
URL: https://huntr.dev/_nuxt/06b2c2f.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:214f:9c00:14:bb32:5f00:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

cc5636ad148856af68c9939793223315481995597a8ed13b903367ff59973f80

Security Headers

Name	Value
Content-Security-Policy	style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://heapanalytics.com; connect-src 'self' https://cdn.segment.com https://.ingest.sentry.io https://.hotjar.com https://.hotjar.io https://.huntr.dev https://.appsync-api.eu-west-1.amazonaws.com https://api.github.com https://api.bloggify.net https://heapanalytics.com https://api.segment.io wss://.hotjar.com https://app.posthog.com https://app.chatwoot.com; script-src 'self' 'unsafe-inline' https://browser.sentry-cdn.com https://cdn.heapanalytics.com https://heapanalytics.com https://*.hotjar.com https://app.chatwoot.com https://cdn.segment.com; font-src 'self' data: https://fonts.gstatic.com; child-src blob: https://www.youtube.com https://app.chatwoot.com https://vars.hotjar.com https://www.podbean.com;
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://huntr.dev/bounties/31ac0506-ae38-4128-a46d-71d5d079f8b7/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Wed, 21 Sep 2022 19:54:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-amz-cf-pop: FRA53-C1
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
vary: Accept-Encoding
x-xss-protection: 1; mode=block
last-modified: Tue, 13 Sep 2022 20:42:56 GMT
server: AmazonS3
x-frame-options: SAMEORIGIN
etag: W/"028367d1e7ef51e8674b0812979d05ba"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript
via: 1.1 a4a46c5a6cdf81ec1d08cf6e63389764.cloudfront.net (CloudFront)
cache-control: public, max-age=0, s-maxage=600
content-security-policy: style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://heapanalytics.com; connect-src 'self' https://cdn.segment.com https://*.ingest.sentry.io https://*.hotjar.com https://*.hotjar.io https://*.huntr.dev https://*.appsync-api.eu-west-1.amazonaws.com https://api.github.com https://api.bloggify.net https://heapanalytics.com https://api.segment.io wss://*.hotjar.com https://app.posthog.com https://app.chatwoot.com; script-src 'self' 'unsafe-inline' https://browser.sentry-cdn.com https://cdn.heapanalytics.com https://heapanalytics.com https://*.hotjar.com https://app.chatwoot.com https://cdn.segment.com; font-src 'self' data: https://fonts.gstatic.com; child-src blob: https://www.youtube.com https://app.chatwoot.com https://vars.hotjar.com https://www.podbean.com;
x-amz-cf-id: BGaouGaBQEPvyI4Pxoq8nb-YyzshzpxzcAD0DkMbvL1p2iplwAynpQ==

GET
H2 200 90ffc7c.js Show response
huntr.dev/_nuxt/ 9 KB
4 KB 113ms
112ms Script
application/javascript 2600:9000:214f:9c00:14:bb32:5f00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://huntr.dev/_nuxt/90ffc7c.js

Requested by

Host: huntr.dev
URL: https://huntr.dev/_nuxt/2c71194.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:214f:9c00:14:bb32:5f00:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

1d589d1cfd1183c8d6cbc70d793d500f325a4e114b7362d9f7db65e090a120c7

Security Headers

Name	Value
Content-Security-Policy	style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://heapanalytics.com; connect-src 'self' https://cdn.segment.com https://.ingest.sentry.io https://.hotjar.com https://.hotjar.io https://.huntr.dev https://.appsync-api.eu-west-1.amazonaws.com https://api.github.com https://api.bloggify.net https://heapanalytics.com https://api.segment.io wss://.hotjar.com https://app.posthog.com https://app.chatwoot.com; script-src 'self' 'unsafe-inline' https://browser.sentry-cdn.com https://cdn.heapanalytics.com https://heapanalytics.com https://*.hotjar.com https://app.chatwoot.com https://cdn.segment.com; font-src 'self' data: https://fonts.gstatic.com; child-src blob: https://www.youtube.com https://app.chatwoot.com https://vars.hotjar.com https://www.podbean.com;
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://huntr.dev/bounties/31ac0506-ae38-4128-a46d-71d5d079f8b7/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Wed, 21 Sep 2022 19:54:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-amz-cf-pop: FRA53-C1
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
vary: Accept-Encoding
x-xss-protection: 1; mode=block
last-modified: Tue, 13 Sep 2022 20:42:30 GMT
server: AmazonS3
x-frame-options: SAMEORIGIN
etag: W/"d544167a2d1ef69df4029d965cb69931"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript
via: 1.1 a4a46c5a6cdf81ec1d08cf6e63389764.cloudfront.net (CloudFront)
cache-control: public, max-age=0, s-maxage=600
content-security-policy: style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://heapanalytics.com; connect-src 'self' https://cdn.segment.com https://*.ingest.sentry.io https://*.hotjar.com https://*.hotjar.io https://*.huntr.dev https://*.appsync-api.eu-west-1.amazonaws.com https://api.github.com https://api.bloggify.net https://heapanalytics.com https://api.segment.io wss://*.hotjar.com https://app.posthog.com https://app.chatwoot.com; script-src 'self' 'unsafe-inline' https://browser.sentry-cdn.com https://cdn.heapanalytics.com https://heapanalytics.com https://*.hotjar.com https://app.chatwoot.com https://cdn.segment.com; font-src 'self' data: https://fonts.gstatic.com; child-src blob: https://www.youtube.com https://app.chatwoot.com https://vars.hotjar.com https://www.podbean.com;
x-amz-cf-id: VVBfndWW7XumfLXatjDkDb3buCqJTBcq0t9ufjd_omhhkGNZnJF_Mg==

GET
H2 200 4dab567.js Show response
huntr.dev/_nuxt/ 68 KB
18 KB 151ms
151ms Script
application/javascript 2600:9000:214f:9c00:14:bb32:5f00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://huntr.dev/_nuxt/4dab567.js

Requested by

Host: huntr.dev
URL: https://huntr.dev/_nuxt/2c71194.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:214f:9c00:14:bb32:5f00:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

f4982eb597ebc7e4f986223cfadd738dcb6c1c10b075d2b73e46e5c152f406d9

Security Headers

Name	Value
Content-Security-Policy	style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://heapanalytics.com; connect-src 'self' https://cdn.segment.com https://.ingest.sentry.io https://.hotjar.com https://.hotjar.io https://.huntr.dev https://.appsync-api.eu-west-1.amazonaws.com https://api.github.com https://api.bloggify.net https://heapanalytics.com https://api.segment.io wss://.hotjar.com https://app.posthog.com https://app.chatwoot.com; script-src 'self' 'unsafe-inline' https://browser.sentry-cdn.com https://cdn.heapanalytics.com https://heapanalytics.com https://*.hotjar.com https://app.chatwoot.com https://cdn.segment.com; font-src 'self' data: https://fonts.gstatic.com; child-src blob: https://www.youtube.com https://app.chatwoot.com https://vars.hotjar.com https://www.podbean.com;
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://huntr.dev/bounties/31ac0506-ae38-4128-a46d-71d5d079f8b7/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Wed, 21 Sep 2022 19:54:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-amz-cf-pop: FRA53-C1
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
vary: Accept-Encoding
x-xss-protection: 1; mode=block
last-modified: Tue, 13 Sep 2022 20:42:30 GMT
server: AmazonS3
x-frame-options: SAMEORIGIN
etag: W/"935320e2eb0905f96f3ebe658770f1b2"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript
via: 1.1 a4a46c5a6cdf81ec1d08cf6e63389764.cloudfront.net (CloudFront)
cache-control: public, max-age=0, s-maxage=600
content-security-policy: style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://heapanalytics.com; connect-src 'self' https://cdn.segment.com https://*.ingest.sentry.io https://*.hotjar.com https://*.hotjar.io https://*.huntr.dev https://*.appsync-api.eu-west-1.amazonaws.com https://api.github.com https://api.bloggify.net https://heapanalytics.com https://api.segment.io wss://*.hotjar.com https://app.posthog.com https://app.chatwoot.com; script-src 'self' 'unsafe-inline' https://browser.sentry-cdn.com https://cdn.heapanalytics.com https://heapanalytics.com https://*.hotjar.com https://app.chatwoot.com https://cdn.segment.com; font-src 'self' data: https://fonts.gstatic.com; child-src blob: https://www.youtube.com https://app.chatwoot.com https://vars.hotjar.com https://www.podbean.com;
x-amz-cf-id: Vddql0kBNKc10A1vk8Ye92BEdfsFPWReraSossOXS4IKb_I-c7aCUw==

GET
H2 200 f122d72.js Show response
huntr.dev/_nuxt/ 17 KB
6 KB 120ms
119ms Script
application/javascript 2600:9000:214f:9c00:14:bb32:5f00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://huntr.dev/_nuxt/f122d72.js

Requested by

Host: huntr.dev
URL: https://huntr.dev/_nuxt/2c71194.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:214f:9c00:14:bb32:5f00:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

576cfcae3e1ad3dd2bde162d6917c03842baf18a65ca68f1b42698a52a303539

Security Headers

Name	Value
Content-Security-Policy	style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://heapanalytics.com; connect-src 'self' https://cdn.segment.com https://.ingest.sentry.io https://.hotjar.com https://.hotjar.io https://.huntr.dev https://.appsync-api.eu-west-1.amazonaws.com https://api.github.com https://api.bloggify.net https://heapanalytics.com https://api.segment.io wss://.hotjar.com https://app.posthog.com https://app.chatwoot.com; script-src 'self' 'unsafe-inline' https://browser.sentry-cdn.com https://cdn.heapanalytics.com https://heapanalytics.com https://*.hotjar.com https://app.chatwoot.com https://cdn.segment.com; font-src 'self' data: https://fonts.gstatic.com; child-src blob: https://www.youtube.com https://app.chatwoot.com https://vars.hotjar.com https://www.podbean.com;
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://huntr.dev/bounties/31ac0506-ae38-4128-a46d-71d5d079f8b7/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Wed, 21 Sep 2022 19:54:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-amz-cf-pop: FRA53-C1
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
vary: Accept-Encoding
x-xss-protection: 1; mode=block
last-modified: Tue, 13 Sep 2022 20:42:30 GMT
server: AmazonS3
x-frame-options: SAMEORIGIN
etag: W/"dc7144cc23b121c00b68f2113d5e80fc"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript
via: 1.1 a4a46c5a6cdf81ec1d08cf6e63389764.cloudfront.net (CloudFront)
cache-control: public, max-age=0, s-maxage=600
content-security-policy: style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://heapanalytics.com; connect-src 'self' https://cdn.segment.com https://*.ingest.sentry.io https://*.hotjar.com https://*.hotjar.io https://*.huntr.dev https://*.appsync-api.eu-west-1.amazonaws.com https://api.github.com https://api.bloggify.net https://heapanalytics.com https://api.segment.io wss://*.hotjar.com https://app.posthog.com https://app.chatwoot.com; script-src 'self' 'unsafe-inline' https://browser.sentry-cdn.com https://cdn.heapanalytics.com https://heapanalytics.com https://*.hotjar.com https://app.chatwoot.com https://cdn.segment.com; font-src 'self' data: https://fonts.gstatic.com; child-src blob: https://www.youtube.com https://app.chatwoot.com https://vars.hotjar.com https://www.podbean.com;
x-amz-cf-id: maGn0_uG-XVv58L_JNfle-_somhqVqSLeVGxAx9GFqc0-A1UDqM3NQ==

GET
H2 200 f7ab05f.js Show response
huntr.dev/_nuxt/ 19 KB
7 KB 117ms
117ms Script
application/javascript 2600:9000:214f:9c00:14:bb32:5f00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://huntr.dev/_nuxt/f7ab05f.js

Requested by

Host: huntr.dev
URL: https://huntr.dev/_nuxt/2c71194.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:214f:9c00:14:bb32:5f00:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

80c5641568702dee9452648cad502cea5339a5764e95c1edde62793b4802b241

Security Headers

Name	Value
Content-Security-Policy	style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://heapanalytics.com; connect-src 'self' https://cdn.segment.com https://.ingest.sentry.io https://.hotjar.com https://.hotjar.io https://.huntr.dev https://.appsync-api.eu-west-1.amazonaws.com https://api.github.com https://api.bloggify.net https://heapanalytics.com https://api.segment.io wss://.hotjar.com https://app.posthog.com https://app.chatwoot.com; script-src 'self' 'unsafe-inline' https://browser.sentry-cdn.com https://cdn.heapanalytics.com https://heapanalytics.com https://*.hotjar.com https://app.chatwoot.com https://cdn.segment.com; font-src 'self' data: https://fonts.gstatic.com; child-src blob: https://www.youtube.com https://app.chatwoot.com https://vars.hotjar.com https://www.podbean.com;
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://huntr.dev/bounties/31ac0506-ae38-4128-a46d-71d5d079f8b7/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Wed, 21 Sep 2022 19:54:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-amz-cf-pop: FRA53-C1
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
vary: Accept-Encoding
x-xss-protection: 1; mode=block
last-modified: Tue, 13 Sep 2022 20:42:30 GMT
server: AmazonS3
x-frame-options: SAMEORIGIN
etag: W/"e0fd7a70b48406f626760a6c8b4f4c9f"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript
via: 1.1 a4a46c5a6cdf81ec1d08cf6e63389764.cloudfront.net (CloudFront)
cache-control: public, max-age=0, s-maxage=600
content-security-policy: style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://heapanalytics.com; connect-src 'self' https://cdn.segment.com https://*.ingest.sentry.io https://*.hotjar.com https://*.hotjar.io https://*.huntr.dev https://*.appsync-api.eu-west-1.amazonaws.com https://api.github.com https://api.bloggify.net https://heapanalytics.com https://api.segment.io wss://*.hotjar.com https://app.posthog.com https://app.chatwoot.com; script-src 'self' 'unsafe-inline' https://browser.sentry-cdn.com https://cdn.heapanalytics.com https://heapanalytics.com https://*.hotjar.com https://app.chatwoot.com https://cdn.segment.com; font-src 'self' data: https://fonts.gstatic.com; child-src blob: https://www.youtube.com https://app.chatwoot.com https://vars.hotjar.com https://www.podbean.com;
x-amz-cf-id: SNynE1EP1UVbwV8HV1JUANvcCLoDvqFnRhYz72eRbdBK5TUnfIpS2Q==

GET
H2 200 01153b0.js Show response
huntr.dev/_nuxt/ 26 KB
8 KB 107ms
107ms Script
application/javascript 2600:9000:214f:9c00:14:bb32:5f00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://huntr.dev/_nuxt/01153b0.js

Requested by

Host: huntr.dev
URL: https://huntr.dev/_nuxt/2c71194.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:214f:9c00:14:bb32:5f00:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

89060a5aaf5b8d9b7eb3e5fb336cbae933294420f7f4983eae7c916f395cf304

Security Headers

Name	Value
Content-Security-Policy	style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://heapanalytics.com; connect-src 'self' https://cdn.segment.com https://.ingest.sentry.io https://.hotjar.com https://.hotjar.io https://.huntr.dev https://.appsync-api.eu-west-1.amazonaws.com https://api.github.com https://api.bloggify.net https://heapanalytics.com https://api.segment.io wss://.hotjar.com https://app.posthog.com https://app.chatwoot.com; script-src 'self' 'unsafe-inline' https://browser.sentry-cdn.com https://cdn.heapanalytics.com https://heapanalytics.com https://*.hotjar.com https://app.chatwoot.com https://cdn.segment.com; font-src 'self' data: https://fonts.gstatic.com; child-src blob: https://www.youtube.com https://app.chatwoot.com https://vars.hotjar.com https://www.podbean.com;
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://huntr.dev/bounties/31ac0506-ae38-4128-a46d-71d5d079f8b7/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Wed, 21 Sep 2022 19:54:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-amz-cf-pop: FRA53-C1
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
vary: Accept-Encoding
x-xss-protection: 1; mode=block
last-modified: Tue, 13 Sep 2022 20:42:30 GMT
server: AmazonS3
x-frame-options: SAMEORIGIN
etag: W/"ccf7befe53eec5e173c3f294ae480f4d"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript
via: 1.1 a4a46c5a6cdf81ec1d08cf6e63389764.cloudfront.net (CloudFront)
cache-control: public, max-age=0, s-maxage=600
content-security-policy: style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://heapanalytics.com; connect-src 'self' https://cdn.segment.com https://*.ingest.sentry.io https://*.hotjar.com https://*.hotjar.io https://*.huntr.dev https://*.appsync-api.eu-west-1.amazonaws.com https://api.github.com https://api.bloggify.net https://heapanalytics.com https://api.segment.io wss://*.hotjar.com https://app.posthog.com https://app.chatwoot.com; script-src 'self' 'unsafe-inline' https://browser.sentry-cdn.com https://cdn.heapanalytics.com https://heapanalytics.com https://*.hotjar.com https://app.chatwoot.com https://cdn.segment.com; font-src 'self' data: https://fonts.gstatic.com; child-src blob: https://www.youtube.com https://app.chatwoot.com https://vars.hotjar.com https://www.podbean.com;
x-amz-cf-id: 0QExI7xG5mFAOcN8s12qd3qHizqIw5isib2MDowexOMcZiGmJv66ew==

GET
H2 200 d0f8b0a.js Show response
huntr.dev/_nuxt/ 4 KB
3 KB 123ms
123ms Script
application/javascript 2600:9000:214f:9c00:14:bb32:5f00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://huntr.dev/_nuxt/d0f8b0a.js

Requested by

Host: huntr.dev
URL: https://huntr.dev/_nuxt/2c71194.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:214f:9c00:14:bb32:5f00:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

08a0dadd9f2fd9d9aea51b8c07c2d84f2c98d86880c99fe0e8bea14fe0483fce

Security Headers

Name	Value
Content-Security-Policy	style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://heapanalytics.com; connect-src 'self' https://cdn.segment.com https://.ingest.sentry.io https://.hotjar.com https://.hotjar.io https://.huntr.dev https://.appsync-api.eu-west-1.amazonaws.com https://api.github.com https://api.bloggify.net https://heapanalytics.com https://api.segment.io wss://.hotjar.com https://app.posthog.com https://app.chatwoot.com; script-src 'self' 'unsafe-inline' https://browser.sentry-cdn.com https://cdn.heapanalytics.com https://heapanalytics.com https://*.hotjar.com https://app.chatwoot.com https://cdn.segment.com; font-src 'self' data: https://fonts.gstatic.com; child-src blob: https://www.youtube.com https://app.chatwoot.com https://vars.hotjar.com https://www.podbean.com;
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://huntr.dev/bounties/31ac0506-ae38-4128-a46d-71d5d079f8b7/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Wed, 21 Sep 2022 19:54:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-amz-cf-pop: FRA53-C1
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
vary: Accept-Encoding
x-xss-protection: 1; mode=block
last-modified: Tue, 13 Sep 2022 20:42:30 GMT
server: AmazonS3
x-frame-options: SAMEORIGIN
etag: W/"3aa1a440d42818e8daecd18ad748efae"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript
via: 1.1 a4a46c5a6cdf81ec1d08cf6e63389764.cloudfront.net (CloudFront)
cache-control: public, max-age=0, s-maxage=600
content-security-policy: style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://heapanalytics.com; connect-src 'self' https://cdn.segment.com https://*.ingest.sentry.io https://*.hotjar.com https://*.hotjar.io https://*.huntr.dev https://*.appsync-api.eu-west-1.amazonaws.com https://api.github.com https://api.bloggify.net https://heapanalytics.com https://api.segment.io wss://*.hotjar.com https://app.posthog.com https://app.chatwoot.com; script-src 'self' 'unsafe-inline' https://browser.sentry-cdn.com https://cdn.heapanalytics.com https://heapanalytics.com https://*.hotjar.com https://app.chatwoot.com https://cdn.segment.com; font-src 'self' data: https://fonts.gstatic.com; child-src blob: https://www.youtube.com https://app.chatwoot.com https://vars.hotjar.com https://www.podbean.com;
x-amz-cf-id: javNl_B3-Vs3ek_waa--0KzivhkebagBX3_44FfjmqiF4y3sk6Qutg==

GET
H2 200 a725e62.js Show response
huntr.dev/_nuxt/ 19 KB
6 KB 131ms
131ms Script
application/javascript 2600:9000:214f:9c00:14:bb32:5f00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://huntr.dev/_nuxt/a725e62.js

Requested by

Host: huntr.dev
URL: https://huntr.dev/_nuxt/2c71194.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:214f:9c00:14:bb32:5f00:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

0916dd4cdded5f7f2bc077d4cd5cf4704c0e9972a891aadf5359bf8e62c493d3

Security Headers

Name	Value
Content-Security-Policy	style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://heapanalytics.com; connect-src 'self' https://cdn.segment.com https://.ingest.sentry.io https://.hotjar.com https://.hotjar.io https://.huntr.dev https://.appsync-api.eu-west-1.amazonaws.com https://api.github.com https://api.bloggify.net https://heapanalytics.com https://api.segment.io wss://.hotjar.com https://app.posthog.com https://app.chatwoot.com; script-src 'self' 'unsafe-inline' https://browser.sentry-cdn.com https://cdn.heapanalytics.com https://heapanalytics.com https://*.hotjar.com https://app.chatwoot.com https://cdn.segment.com; font-src 'self' data: https://fonts.gstatic.com; child-src blob: https://www.youtube.com https://app.chatwoot.com https://vars.hotjar.com https://www.podbean.com;
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://huntr.dev/bounties/31ac0506-ae38-4128-a46d-71d5d079f8b7/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Wed, 21 Sep 2022 19:54:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-amz-cf-pop: FRA53-C1
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
vary: Accept-Encoding
x-xss-protection: 1; mode=block
last-modified: Tue, 13 Sep 2022 20:42:30 GMT
server: AmazonS3
x-frame-options: SAMEORIGIN
etag: W/"2fc59faab197f28771efd964aea8a540"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript
via: 1.1 a4a46c5a6cdf81ec1d08cf6e63389764.cloudfront.net (CloudFront)
cache-control: public, max-age=0, s-maxage=600
content-security-policy: style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://heapanalytics.com; connect-src 'self' https://cdn.segment.com https://*.ingest.sentry.io https://*.hotjar.com https://*.hotjar.io https://*.huntr.dev https://*.appsync-api.eu-west-1.amazonaws.com https://api.github.com https://api.bloggify.net https://heapanalytics.com https://api.segment.io wss://*.hotjar.com https://app.posthog.com https://app.chatwoot.com; script-src 'self' 'unsafe-inline' https://browser.sentry-cdn.com https://cdn.heapanalytics.com https://heapanalytics.com https://*.hotjar.com https://app.chatwoot.com https://cdn.segment.com; font-src 'self' data: https://fonts.gstatic.com; child-src blob: https://www.youtube.com https://app.chatwoot.com https://vars.hotjar.com https://www.podbean.com;
x-amz-cf-id: XF6vF6JbaqB3BkZswEGa_NLMy0lLlQATNCuYD6kXjVMkCNnX4oNtzw==

GET
H2 200 aa17f56.js Show response
huntr.dev/_nuxt/ 1 KB
2 KB 125ms
124ms Script
application/javascript 2600:9000:214f:9c00:14:bb32:5f00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://huntr.dev/_nuxt/aa17f56.js

Requested by

Host: huntr.dev
URL: https://huntr.dev/_nuxt/2c71194.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:214f:9c00:14:bb32:5f00:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

87aa89bced2db81255e5bffd86f653b840cb266cd52d0508b43a6e7fb373987f

Security Headers

Name	Value
Content-Security-Policy	style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://heapanalytics.com; connect-src 'self' https://cdn.segment.com https://.ingest.sentry.io https://.hotjar.com https://.hotjar.io https://.huntr.dev https://.appsync-api.eu-west-1.amazonaws.com https://api.github.com https://api.bloggify.net https://heapanalytics.com https://api.segment.io wss://.hotjar.com https://app.posthog.com https://app.chatwoot.com; script-src 'self' 'unsafe-inline' https://browser.sentry-cdn.com https://cdn.heapanalytics.com https://heapanalytics.com https://*.hotjar.com https://app.chatwoot.com https://cdn.segment.com; font-src 'self' data: https://fonts.gstatic.com; child-src blob: https://www.youtube.com https://app.chatwoot.com https://vars.hotjar.com https://www.podbean.com;
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://huntr.dev/bounties/31ac0506-ae38-4128-a46d-71d5d079f8b7/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Wed, 21 Sep 2022 19:54:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-amz-cf-pop: FRA53-C1
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
vary: Accept-Encoding
x-xss-protection: 1; mode=block
last-modified: Tue, 13 Sep 2022 20:42:30 GMT
server: AmazonS3
x-frame-options: SAMEORIGIN
etag: W/"266881990b03597bf9a6e21c06dbbdf2"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript
via: 1.1 a4a46c5a6cdf81ec1d08cf6e63389764.cloudfront.net (CloudFront)
cache-control: public, max-age=0, s-maxage=600
content-security-policy: style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://heapanalytics.com; connect-src 'self' https://cdn.segment.com https://*.ingest.sentry.io https://*.hotjar.com https://*.hotjar.io https://*.huntr.dev https://*.appsync-api.eu-west-1.amazonaws.com https://api.github.com https://api.bloggify.net https://heapanalytics.com https://api.segment.io wss://*.hotjar.com https://app.posthog.com https://app.chatwoot.com; script-src 'self' 'unsafe-inline' https://browser.sentry-cdn.com https://cdn.heapanalytics.com https://heapanalytics.com https://*.hotjar.com https://app.chatwoot.com https://cdn.segment.com; font-src 'self' data: https://fonts.gstatic.com; child-src blob: https://www.youtube.com https://app.chatwoot.com https://vars.hotjar.com https://www.podbean.com;
x-amz-cf-id: ZH_ThlZHO_p7Uw2WKZCx2KnFKkkB7wkhbJeAK-eULa_9ubP8U9pSWw==

GET
H2 200 74059f0.js Show response
huntr.dev/_nuxt/ 1 KB
2 KB 119ms
119ms Script
application/javascript 2600:9000:214f:9c00:14:bb32:5f00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://huntr.dev/_nuxt/74059f0.js

Requested by

Host: huntr.dev
URL: https://huntr.dev/_nuxt/2c71194.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:214f:9c00:14:bb32:5f00:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

a52ff266a8e0b61ef8f778ee06bd7342ade91db379a0dda95d687e7e1d508c55

Security Headers

Name	Value
Content-Security-Policy	style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://heapanalytics.com; connect-src 'self' https://cdn.segment.com https://.ingest.sentry.io https://.hotjar.com https://.hotjar.io https://.huntr.dev https://.appsync-api.eu-west-1.amazonaws.com https://api.github.com https://api.bloggify.net https://heapanalytics.com https://api.segment.io wss://.hotjar.com https://app.posthog.com https://app.chatwoot.com; script-src 'self' 'unsafe-inline' https://browser.sentry-cdn.com https://cdn.heapanalytics.com https://heapanalytics.com https://*.hotjar.com https://app.chatwoot.com https://cdn.segment.com; font-src 'self' data: https://fonts.gstatic.com; child-src blob: https://www.youtube.com https://app.chatwoot.com https://vars.hotjar.com https://www.podbean.com;
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://huntr.dev/bounties/31ac0506-ae38-4128-a46d-71d5d079f8b7/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Wed, 21 Sep 2022 19:54:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-amz-cf-pop: FRA53-C1
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
vary: Accept-Encoding
x-xss-protection: 1; mode=block
last-modified: Tue, 13 Sep 2022 20:42:30 GMT
server: AmazonS3
x-frame-options: SAMEORIGIN
etag: W/"bdcce2a481b522212a0d4e7ce6d586f5"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript
via: 1.1 a4a46c5a6cdf81ec1d08cf6e63389764.cloudfront.net (CloudFront)
cache-control: public, max-age=0, s-maxage=600
content-security-policy: style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://heapanalytics.com; connect-src 'self' https://cdn.segment.com https://*.ingest.sentry.io https://*.hotjar.com https://*.hotjar.io https://*.huntr.dev https://*.appsync-api.eu-west-1.amazonaws.com https://api.github.com https://api.bloggify.net https://heapanalytics.com https://api.segment.io wss://*.hotjar.com https://app.posthog.com https://app.chatwoot.com; script-src 'self' 'unsafe-inline' https://browser.sentry-cdn.com https://cdn.heapanalytics.com https://heapanalytics.com https://*.hotjar.com https://app.chatwoot.com https://cdn.segment.com; font-src 'self' data: https://fonts.gstatic.com; child-src blob: https://www.youtube.com https://app.chatwoot.com https://vars.hotjar.com https://www.podbean.com;
x-amz-cf-id: YLERJhOllhJrfOzq8y3iHctHIoHcDOE0i20Hx32Kth-2wXzqzGr8aw==

GET
H2 200 d25e7cc.js Show response
huntr.dev/_nuxt/ 138 KB
34 KB 125ms
125ms Script
application/javascript 2600:9000:214f:9c00:14:bb32:5f00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://huntr.dev/_nuxt/d25e7cc.js

Requested by

Host: huntr.dev
URL: https://huntr.dev/_nuxt/2c71194.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:214f:9c00:14:bb32:5f00:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

8c3baaff57a8d024482677afa23e73c21112b96e424fb538a569fc9928ea106c

Security Headers

Name	Value
Content-Security-Policy	style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://heapanalytics.com; connect-src 'self' https://cdn.segment.com https://.ingest.sentry.io https://.hotjar.com https://.hotjar.io https://.huntr.dev https://.appsync-api.eu-west-1.amazonaws.com https://api.github.com https://api.bloggify.net https://heapanalytics.com https://api.segment.io wss://.hotjar.com https://app.posthog.com https://app.chatwoot.com; script-src 'self' 'unsafe-inline' https://browser.sentry-cdn.com https://cdn.heapanalytics.com https://heapanalytics.com https://*.hotjar.com https://app.chatwoot.com https://cdn.segment.com; font-src 'self' data: https://fonts.gstatic.com; child-src blob: https://www.youtube.com https://app.chatwoot.com https://vars.hotjar.com https://www.podbean.com;
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://huntr.dev/bounties/31ac0506-ae38-4128-a46d-71d5d079f8b7/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Wed, 21 Sep 2022 19:54:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-amz-cf-pop: FRA53-C1
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
vary: Accept-Encoding
x-xss-protection: 1; mode=block
last-modified: Tue, 13 Sep 2022 20:42:30 GMT
server: AmazonS3
x-frame-options: SAMEORIGIN
etag: W/"a9d86bcbabb57e7712c7582d79d79063"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript
via: 1.1 a4a46c5a6cdf81ec1d08cf6e63389764.cloudfront.net (CloudFront)
cache-control: public, max-age=0, s-maxage=600
content-security-policy: style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://heapanalytics.com; connect-src 'self' https://cdn.segment.com https://*.ingest.sentry.io https://*.hotjar.com https://*.hotjar.io https://*.huntr.dev https://*.appsync-api.eu-west-1.amazonaws.com https://api.github.com https://api.bloggify.net https://heapanalytics.com https://api.segment.io wss://*.hotjar.com https://app.posthog.com https://app.chatwoot.com; script-src 'self' 'unsafe-inline' https://browser.sentry-cdn.com https://cdn.heapanalytics.com https://heapanalytics.com https://*.hotjar.com https://app.chatwoot.com https://cdn.segment.com; font-src 'self' data: https://fonts.gstatic.com; child-src blob: https://www.youtube.com https://app.chatwoot.com https://vars.hotjar.com https://www.podbean.com;
x-amz-cf-id: ji2D6Bo0212FW3h3jTUa82o58Sz_QfuhnyEquPkeFsmtFGDtOj3qjg==

GET
H2 200 settings Show response
cdn.segment.com/v1/projects/VWwEgATDMwku1jvgt0soCRaORr8xbOyx/ 2 KB
1 KB 114ms
38ms XHR
application/json 13.225.79.112
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.segment.com/v1/projects/VWwEgATDMwku1jvgt0soCRaORr8xbOyx/settings
Requested by: Host: cdn.segment.com
URL: https://cdn.segment.com/analytics.js/v1/VWwEgATDMwku1jvgt0soCRaORr8xbOyx/analytics.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.79.112 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-79-112.fra2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: c15d07f9d87fea851ff9306ff597b442e7ca8f6b306acaf6fe753ed259decee4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://huntr.dev/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

x-amz-version-id: i9_qgm6tEM5rZut_i1KSuO6gKrVDsodO
content-encoding: gzip
etag: W/"749a45c0a89b0126d214cd63e5d896fb"
age: 6821
x-cache: Hit from cloudfront
access-control-max-age: 3000
x-amz-replication-status: COMPLETED
access-control-allow-origin: *
last-modified: Thu, 16 Jun 2022 18:54:24 GMT
server: AmazonS3
date: Wed, 21 Sep 2022 18:01:07 GMT
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/json; charset=utf-8
via: 1.1 e56e6732f380db727425bac2d6158760.cloudfront.net (CloudFront)
cache-control: public, max-age=10800
x-amz-cf-pop: FRA2-C2
x-amz-cf-id: tEvfeaTejHzX9pRE7n83imBUO5AiZRdHwxWmx5_kPfeB6Qbpm2QmZQ==

GET
H2 200 payload.js Show response
huntr.dev/_nuxt/static/1663100578/ 1 KB
1 KB 118ms
116ms Script
application/javascript 2600:9000:214f:9c00:14:bb32:5f00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://huntr.dev/_nuxt/static/1663100578/payload.js

Requested by

Host: huntr.dev
URL: https://huntr.dev/_nuxt/06b2c2f.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:214f:9c00:14:bb32:5f00:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

7e7056490a6aa47842422c016c7990d2621f7efb96114ba073809ca7ef306489

Security Headers

Name	Value
Content-Security-Policy	style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://heapanalytics.com; connect-src 'self' https://cdn.segment.com https://.ingest.sentry.io https://.hotjar.com https://.hotjar.io https://.huntr.dev https://.appsync-api.eu-west-1.amazonaws.com https://api.github.com https://api.bloggify.net https://heapanalytics.com https://api.segment.io wss://.hotjar.com https://app.posthog.com https://app.chatwoot.com; script-src 'self' 'unsafe-inline' https://browser.sentry-cdn.com https://cdn.heapanalytics.com https://heapanalytics.com https://*.hotjar.com https://app.chatwoot.com https://cdn.segment.com; font-src 'self' data: https://fonts.gstatic.com; child-src blob: https://www.youtube.com https://app.chatwoot.com https://vars.hotjar.com https://www.podbean.com;
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://huntr.dev/bounties/31ac0506-ae38-4128-a46d-71d5d079f8b7/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Wed, 21 Sep 2022 19:54:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-amz-cf-pop: FRA53-C1
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
vary: Accept-Encoding
x-xss-protection: 1; mode=block
last-modified: Tue, 13 Sep 2022 20:42:56 GMT
server: AmazonS3
x-frame-options: SAMEORIGIN
etag: W/"126dd630135f2a51a22e58e9f9dbb73b"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript
via: 1.1 a4a46c5a6cdf81ec1d08cf6e63389764.cloudfront.net (CloudFront)
cache-control: public, max-age=0, s-maxage=600
content-security-policy: style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://heapanalytics.com; connect-src 'self' https://cdn.segment.com https://*.ingest.sentry.io https://*.hotjar.com https://*.hotjar.io https://*.huntr.dev https://*.appsync-api.eu-west-1.amazonaws.com https://api.github.com https://api.bloggify.net https://heapanalytics.com https://api.segment.io wss://*.hotjar.com https://app.posthog.com https://app.chatwoot.com; script-src 'self' 'unsafe-inline' https://browser.sentry-cdn.com https://cdn.heapanalytics.com https://heapanalytics.com https://*.hotjar.com https://app.chatwoot.com https://cdn.segment.com; font-src 'self' data: https://fonts.gstatic.com; child-src blob: https://www.youtube.com https://app.chatwoot.com https://vars.hotjar.com https://www.podbean.com;
x-amz-cf-id: ZasmrN-L6oPpeZ2L62jqz94eXzG4ugpPiS40NTWA6_L7j8fPbUgc5g==

GET
H2 200 payload.js Show response
huntr.dev/_nuxt/static/1663100578/bounties/ 70 B
1 KB 139ms
135ms Script
application/javascript 2600:9000:214f:9c00:14:bb32:5f00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://huntr.dev/_nuxt/static/1663100578/bounties/payload.js

Requested by

Host: huntr.dev
URL: https://huntr.dev/_nuxt/06b2c2f.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:214f:9c00:14:bb32:5f00:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

373059db7c24b296fc0a96692d7eecb9249d4274128de91c553bc70467c7d8ce

Security Headers

Name	Value
Content-Security-Policy	style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://heapanalytics.com; connect-src 'self' https://cdn.segment.com https://.ingest.sentry.io https://.hotjar.com https://.hotjar.io https://.huntr.dev https://.appsync-api.eu-west-1.amazonaws.com https://api.github.com https://api.bloggify.net https://heapanalytics.com https://api.segment.io wss://.hotjar.com https://app.posthog.com https://app.chatwoot.com; script-src 'self' 'unsafe-inline' https://browser.sentry-cdn.com https://cdn.heapanalytics.com https://heapanalytics.com https://*.hotjar.com https://app.chatwoot.com https://cdn.segment.com; font-src 'self' data: https://fonts.gstatic.com; child-src blob: https://www.youtube.com https://app.chatwoot.com https://vars.hotjar.com https://www.podbean.com;
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://huntr.dev/bounties/31ac0506-ae38-4128-a46d-71d5d079f8b7/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Wed, 21 Sep 2022 19:54:48 GMT
via: 1.1 a4a46c5a6cdf81ec1d08cf6e63389764.cloudfront.net (CloudFront)
x-content-type-options: nosniff
x-amz-cf-pop: FRA53-C1
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
content-length: 70
x-xss-protection: 1; mode=block
last-modified: Tue, 13 Sep 2022 20:42:56 GMT
server: AmazonS3
x-frame-options: SAMEORIGIN
etag: "ed9a10c88c5ac705aee93e7d26c4fc32"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript
cache-control: public, max-age=0, s-maxage=600
content-security-policy: style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://heapanalytics.com; connect-src 'self' https://cdn.segment.com https://*.ingest.sentry.io https://*.hotjar.com https://*.hotjar.io https://*.huntr.dev https://*.appsync-api.eu-west-1.amazonaws.com https://api.github.com https://api.bloggify.net https://heapanalytics.com https://api.segment.io wss://*.hotjar.com https://app.posthog.com https://app.chatwoot.com; script-src 'self' 'unsafe-inline' https://browser.sentry-cdn.com https://cdn.heapanalytics.com https://heapanalytics.com https://*.hotjar.com https://app.chatwoot.com https://cdn.segment.com; font-src 'self' data: https://fonts.gstatic.com; child-src blob: https://www.youtube.com https://app.chatwoot.com https://vars.hotjar.com https://www.podbean.com;
accept-ranges: bytes
x-amz-cf-id: jZtIZud-EiLaCzQRXx7xdzEBPy9_WQoEqSxJAi9Xm_4JQpYIEWnKFQ==

GET
H2 200 payload.js Show response
huntr.dev/_nuxt/static/1663100578/bounties/hacktivity/ 81 B
1 KB 105ms
101ms Script
application/javascript 2600:9000:214f:9c00:14:bb32:5f00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://huntr.dev/_nuxt/static/1663100578/bounties/hacktivity/payload.js

Requested by

Host: huntr.dev
URL: https://huntr.dev/_nuxt/06b2c2f.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:214f:9c00:14:bb32:5f00:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

9a279a8cfe3eb891b1a7a5458606ae20be74304c60e05b985f3bea0f6815e96b

Security Headers

Name	Value
Content-Security-Policy	style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://heapanalytics.com; connect-src 'self' https://cdn.segment.com https://.ingest.sentry.io https://.hotjar.com https://.hotjar.io https://.huntr.dev https://.appsync-api.eu-west-1.amazonaws.com https://api.github.com https://api.bloggify.net https://heapanalytics.com https://api.segment.io wss://.hotjar.com https://app.posthog.com https://app.chatwoot.com; script-src 'self' 'unsafe-inline' https://browser.sentry-cdn.com https://cdn.heapanalytics.com https://heapanalytics.com https://*.hotjar.com https://app.chatwoot.com https://cdn.segment.com; font-src 'self' data: https://fonts.gstatic.com; child-src blob: https://www.youtube.com https://app.chatwoot.com https://vars.hotjar.com https://www.podbean.com;
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://huntr.dev/bounties/31ac0506-ae38-4128-a46d-71d5d079f8b7/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Wed, 21 Sep 2022 19:54:48 GMT
via: 1.1 a4a46c5a6cdf81ec1d08cf6e63389764.cloudfront.net (CloudFront)
x-content-type-options: nosniff
x-amz-cf-pop: FRA53-C1
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
content-length: 81
x-xss-protection: 1; mode=block
last-modified: Tue, 13 Sep 2022 20:42:56 GMT
server: AmazonS3
x-frame-options: SAMEORIGIN
etag: "fc04d064f666e6c3a67bfdf89f4b2801"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript
cache-control: public, max-age=0, s-maxage=600
content-security-policy: style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://heapanalytics.com; connect-src 'self' https://cdn.segment.com https://*.ingest.sentry.io https://*.hotjar.com https://*.hotjar.io https://*.huntr.dev https://*.appsync-api.eu-west-1.amazonaws.com https://api.github.com https://api.bloggify.net https://heapanalytics.com https://api.segment.io wss://*.hotjar.com https://app.posthog.com https://app.chatwoot.com; script-src 'self' 'unsafe-inline' https://browser.sentry-cdn.com https://cdn.heapanalytics.com https://heapanalytics.com https://*.hotjar.com https://app.chatwoot.com https://cdn.segment.com; font-src 'self' data: https://fonts.gstatic.com; child-src blob: https://www.youtube.com https://app.chatwoot.com https://vars.hotjar.com https://www.podbean.com;
accept-ranges: bytes
x-amz-cf-id: VAMuDrLOblbZamAsc5BoCPVoLcMFc7HulpqCdT11hePDNvDo6FlP2A==

GET
H2 200 payload.js Show response
huntr.dev/_nuxt/static/1663100578/leaderboard/ 73 B
1 KB 128ms
125ms Script
application/javascript 2600:9000:214f:9c00:14:bb32:5f00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://huntr.dev/_nuxt/static/1663100578/leaderboard/payload.js

Requested by

Host: huntr.dev
URL: https://huntr.dev/_nuxt/06b2c2f.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:214f:9c00:14:bb32:5f00:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

9de1041297927941b9c0d2104c967e3a17544dc79c5c9d49d3500af6397a9f7f

Security Headers

Name	Value
Content-Security-Policy	style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://heapanalytics.com; connect-src 'self' https://cdn.segment.com https://.ingest.sentry.io https://.hotjar.com https://.hotjar.io https://.huntr.dev https://.appsync-api.eu-west-1.amazonaws.com https://api.github.com https://api.bloggify.net https://heapanalytics.com https://api.segment.io wss://.hotjar.com https://app.posthog.com https://app.chatwoot.com; script-src 'self' 'unsafe-inline' https://browser.sentry-cdn.com https://cdn.heapanalytics.com https://heapanalytics.com https://*.hotjar.com https://app.chatwoot.com https://cdn.segment.com; font-src 'self' data: https://fonts.gstatic.com; child-src blob: https://www.youtube.com https://app.chatwoot.com https://vars.hotjar.com https://www.podbean.com;
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://huntr.dev/bounties/31ac0506-ae38-4128-a46d-71d5d079f8b7/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Wed, 21 Sep 2022 19:54:48 GMT
via: 1.1 a4a46c5a6cdf81ec1d08cf6e63389764.cloudfront.net (CloudFront)
x-content-type-options: nosniff
x-amz-cf-pop: FRA53-C1
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
content-length: 73
x-xss-protection: 1; mode=block
last-modified: Tue, 13 Sep 2022 20:42:56 GMT
server: AmazonS3
x-frame-options: SAMEORIGIN
etag: "7dcde85f209c9e271f0e80211fb29626"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript
cache-control: public, max-age=0, s-maxage=600
content-security-policy: style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://heapanalytics.com; connect-src 'self' https://cdn.segment.com https://*.ingest.sentry.io https://*.hotjar.com https://*.hotjar.io https://*.huntr.dev https://*.appsync-api.eu-west-1.amazonaws.com https://api.github.com https://api.bloggify.net https://heapanalytics.com https://api.segment.io wss://*.hotjar.com https://app.posthog.com https://app.chatwoot.com; script-src 'self' 'unsafe-inline' https://browser.sentry-cdn.com https://cdn.heapanalytics.com https://heapanalytics.com https://*.hotjar.com https://app.chatwoot.com https://cdn.segment.com; font-src 'self' data: https://fonts.gstatic.com; child-src blob: https://www.youtube.com https://app.chatwoot.com https://vars.hotjar.com https://www.podbean.com;
accept-ranges: bytes
x-amz-cf-id: p0XSPjJsVx__obrGbGACD-uvJC8GynX13t-aAchb2cNN49a-llRgoQ==

GET
H2 200 payload.js Show response
huntr.dev/_nuxt/static/1663100578/faq/ 16 KB
5 KB 124ms
121ms Script
application/javascript 2600:9000:214f:9c00:14:bb32:5f00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://huntr.dev/_nuxt/static/1663100578/faq/payload.js

Requested by

Host: huntr.dev
URL: https://huntr.dev/_nuxt/06b2c2f.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:214f:9c00:14:bb32:5f00:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

edf1cbc0c73bcd75aab90b3795941f0e7e30efab1f2758065b057253e54e948c

Security Headers

Name	Value
Content-Security-Policy	style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://heapanalytics.com; connect-src 'self' https://cdn.segment.com https://.ingest.sentry.io https://.hotjar.com https://.hotjar.io https://.huntr.dev https://.appsync-api.eu-west-1.amazonaws.com https://api.github.com https://api.bloggify.net https://heapanalytics.com https://api.segment.io wss://.hotjar.com https://app.posthog.com https://app.chatwoot.com; script-src 'self' 'unsafe-inline' https://browser.sentry-cdn.com https://cdn.heapanalytics.com https://heapanalytics.com https://*.hotjar.com https://app.chatwoot.com https://cdn.segment.com; font-src 'self' data: https://fonts.gstatic.com; child-src blob: https://www.youtube.com https://app.chatwoot.com https://vars.hotjar.com https://www.podbean.com;
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://huntr.dev/bounties/31ac0506-ae38-4128-a46d-71d5d079f8b7/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Wed, 21 Sep 2022 19:54:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-amz-cf-pop: FRA53-C1
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
vary: Accept-Encoding
x-xss-protection: 1; mode=block
last-modified: Tue, 13 Sep 2022 20:42:56 GMT
server: AmazonS3
x-frame-options: SAMEORIGIN
etag: W/"1541152e0abee824c25319e4e01d55a5"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript
via: 1.1 a4a46c5a6cdf81ec1d08cf6e63389764.cloudfront.net (CloudFront)
cache-control: public, max-age=0, s-maxage=600
content-security-policy: style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://heapanalytics.com; connect-src 'self' https://cdn.segment.com https://*.ingest.sentry.io https://*.hotjar.com https://*.hotjar.io https://*.huntr.dev https://*.appsync-api.eu-west-1.amazonaws.com https://api.github.com https://api.bloggify.net https://heapanalytics.com https://api.segment.io wss://*.hotjar.com https://app.posthog.com https://app.chatwoot.com; script-src 'self' 'unsafe-inline' https://browser.sentry-cdn.com https://cdn.heapanalytics.com https://heapanalytics.com https://*.hotjar.com https://app.chatwoot.com https://cdn.segment.com; font-src 'self' data: https://fonts.gstatic.com; child-src blob: https://www.youtube.com https://app.chatwoot.com https://vars.hotjar.com https://www.podbean.com;
x-amz-cf-id: 0Wo_ZRqpRCvRzA_30UbMv-1L4PZoucydDnsp43GK_azGicir2v7OIg==

GET
H2 200 payload.js Show response
huntr.dev/_nuxt/static/1663100578/contact-us/ 72 B
1 KB 107ms
104ms Script
application/javascript 2600:9000:214f:9c00:14:bb32:5f00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://huntr.dev/_nuxt/static/1663100578/contact-us/payload.js

Requested by

Host: huntr.dev
URL: https://huntr.dev/_nuxt/06b2c2f.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:214f:9c00:14:bb32:5f00:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

1a37031e6a0feef007ad05ef938452805b8c01fd6a3e3388e62a951c65796df7

Security Headers

Name	Value
Content-Security-Policy	style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://heapanalytics.com; connect-src 'self' https://cdn.segment.com https://.ingest.sentry.io https://.hotjar.com https://.hotjar.io https://.huntr.dev https://.appsync-api.eu-west-1.amazonaws.com https://api.github.com https://api.bloggify.net https://heapanalytics.com https://api.segment.io wss://.hotjar.com https://app.posthog.com https://app.chatwoot.com; script-src 'self' 'unsafe-inline' https://browser.sentry-cdn.com https://cdn.heapanalytics.com https://heapanalytics.com https://*.hotjar.com https://app.chatwoot.com https://cdn.segment.com; font-src 'self' data: https://fonts.gstatic.com; child-src blob: https://www.youtube.com https://app.chatwoot.com https://vars.hotjar.com https://www.podbean.com;
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://huntr.dev/bounties/31ac0506-ae38-4128-a46d-71d5d079f8b7/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Wed, 21 Sep 2022 19:54:48 GMT
via: 1.1 a4a46c5a6cdf81ec1d08cf6e63389764.cloudfront.net (CloudFront)
x-content-type-options: nosniff
x-amz-cf-pop: FRA53-C1
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
content-length: 72
x-xss-protection: 1; mode=block
last-modified: Tue, 13 Sep 2022 20:42:56 GMT
server: AmazonS3
x-frame-options: SAMEORIGIN
etag: "366dc6ea76591bc89566ac85b90aec65"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript
cache-control: public, max-age=0, s-maxage=600
content-security-policy: style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://heapanalytics.com; connect-src 'self' https://cdn.segment.com https://*.ingest.sentry.io https://*.hotjar.com https://*.hotjar.io https://*.huntr.dev https://*.appsync-api.eu-west-1.amazonaws.com https://api.github.com https://api.bloggify.net https://heapanalytics.com https://api.segment.io wss://*.hotjar.com https://app.posthog.com https://app.chatwoot.com; script-src 'self' 'unsafe-inline' https://browser.sentry-cdn.com https://cdn.heapanalytics.com https://heapanalytics.com https://*.hotjar.com https://app.chatwoot.com https://cdn.segment.com; font-src 'self' data: https://fonts.gstatic.com; child-src blob: https://www.youtube.com https://app.chatwoot.com https://vars.hotjar.com https://www.podbean.com;
accept-ranges: bytes
x-amz-cf-id: MkYeB3m13pn-vS3zsft4YDPDV0BRe2kW4BaAAsuK8DjmIG-_hWBFcg==

GET
H2 200 payload.js Show response
huntr.dev/_nuxt/static/1663100578/terms/ 32 KB
10 KB 109ms
106ms Script
application/javascript 2600:9000:214f:9c00:14:bb32:5f00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://huntr.dev/_nuxt/static/1663100578/terms/payload.js

Requested by

Host: huntr.dev
URL: https://huntr.dev/_nuxt/06b2c2f.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:214f:9c00:14:bb32:5f00:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

9c2e90e9aa0e8b34580a9b8d1e015b006983148d3631faedd8c8b0f839f8ada7

Security Headers

Name	Value
Content-Security-Policy	style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://heapanalytics.com; connect-src 'self' https://cdn.segment.com https://.ingest.sentry.io https://.hotjar.com https://.hotjar.io https://.huntr.dev https://.appsync-api.eu-west-1.amazonaws.com https://api.github.com https://api.bloggify.net https://heapanalytics.com https://api.segment.io wss://.hotjar.com https://app.posthog.com https://app.chatwoot.com; script-src 'self' 'unsafe-inline' https://browser.sentry-cdn.com https://cdn.heapanalytics.com https://heapanalytics.com https://*.hotjar.com https://app.chatwoot.com https://cdn.segment.com; font-src 'self' data: https://fonts.gstatic.com; child-src blob: https://www.youtube.com https://app.chatwoot.com https://vars.hotjar.com https://www.podbean.com;
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://huntr.dev/bounties/31ac0506-ae38-4128-a46d-71d5d079f8b7/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Wed, 21 Sep 2022 19:54:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-amz-cf-pop: FRA53-C1
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
vary: Accept-Encoding
x-xss-protection: 1; mode=block
last-modified: Tue, 13 Sep 2022 20:42:57 GMT
server: AmazonS3
x-frame-options: SAMEORIGIN
etag: W/"8045052b1b92b5566abfff700ca358c0"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript
via: 1.1 a4a46c5a6cdf81ec1d08cf6e63389764.cloudfront.net (CloudFront)
cache-control: public, max-age=0, s-maxage=600
content-security-policy: style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://heapanalytics.com; connect-src 'self' https://cdn.segment.com https://*.ingest.sentry.io https://*.hotjar.com https://*.hotjar.io https://*.huntr.dev https://*.appsync-api.eu-west-1.amazonaws.com https://api.github.com https://api.bloggify.net https://heapanalytics.com https://api.segment.io wss://*.hotjar.com https://app.posthog.com https://app.chatwoot.com; script-src 'self' 'unsafe-inline' https://browser.sentry-cdn.com https://cdn.heapanalytics.com https://heapanalytics.com https://*.hotjar.com https://app.chatwoot.com https://cdn.segment.com; font-src 'self' data: https://fonts.gstatic.com; child-src blob: https://www.youtube.com https://app.chatwoot.com https://vars.hotjar.com https://www.podbean.com;
x-amz-cf-id: aa1uKf4NYqAIa2NTNizv85Obr3Uus9XMU1DGIQljpiOzji71LKq2Ng==

GET
H2 200 payload.js Show response
huntr.dev/_nuxt/static/1663100578/privacy/ 35 KB
10 KB 119ms
117ms Script
application/javascript 2600:9000:214f:9c00:14:bb32:5f00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://huntr.dev/_nuxt/static/1663100578/privacy/payload.js

Requested by

Host: huntr.dev
URL: https://huntr.dev/_nuxt/06b2c2f.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:214f:9c00:14:bb32:5f00:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

9f499f6acd4ca570e294eac05c837b263638f678d71f4ec5a57c744a5f5b95df

Security Headers

Name	Value
Content-Security-Policy	style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://heapanalytics.com; connect-src 'self' https://cdn.segment.com https://.ingest.sentry.io https://.hotjar.com https://.hotjar.io https://.huntr.dev https://.appsync-api.eu-west-1.amazonaws.com https://api.github.com https://api.bloggify.net https://heapanalytics.com https://api.segment.io wss://.hotjar.com https://app.posthog.com https://app.chatwoot.com; script-src 'self' 'unsafe-inline' https://browser.sentry-cdn.com https://cdn.heapanalytics.com https://heapanalytics.com https://*.hotjar.com https://app.chatwoot.com https://cdn.segment.com; font-src 'self' data: https://fonts.gstatic.com; child-src blob: https://www.youtube.com https://app.chatwoot.com https://vars.hotjar.com https://www.podbean.com;
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://huntr.dev/bounties/31ac0506-ae38-4128-a46d-71d5d079f8b7/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Wed, 21 Sep 2022 19:54:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-amz-cf-pop: FRA53-C1
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
vary: Accept-Encoding
x-xss-protection: 1; mode=block
last-modified: Tue, 13 Sep 2022 20:42:56 GMT
server: AmazonS3
x-frame-options: SAMEORIGIN
etag: W/"ad607cc6fd64f48b247f2a7969718e51"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript
via: 1.1 a4a46c5a6cdf81ec1d08cf6e63389764.cloudfront.net (CloudFront)
cache-control: public, max-age=0, s-maxage=600
content-security-policy: style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://heapanalytics.com; connect-src 'self' https://cdn.segment.com https://*.ingest.sentry.io https://*.hotjar.com https://*.hotjar.io https://*.huntr.dev https://*.appsync-api.eu-west-1.amazonaws.com https://api.github.com https://api.bloggify.net https://heapanalytics.com https://api.segment.io wss://*.hotjar.com https://app.posthog.com https://app.chatwoot.com; script-src 'self' 'unsafe-inline' https://browser.sentry-cdn.com https://cdn.heapanalytics.com https://heapanalytics.com https://*.hotjar.com https://app.chatwoot.com https://cdn.segment.com; font-src 'self' data: https://fonts.gstatic.com; child-src blob: https://www.youtube.com https://app.chatwoot.com https://vars.hotjar.com https://www.podbean.com;
x-amz-cf-id: -8vM7r5uWWSHNlLIDm2M_BO33Z8c3QVqoIQc4u9uk-yRkJkdfSGKdg==

GET
H2 200 payload.js Show response
huntr.dev/_nuxt/static/1663100578/bounties/disclose/ 79 B
1 KB 101ms
99ms Script
application/javascript 2600:9000:214f:9c00:14:bb32:5f00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://huntr.dev/_nuxt/static/1663100578/bounties/disclose/payload.js

Requested by

Host: huntr.dev
URL: https://huntr.dev/_nuxt/06b2c2f.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:214f:9c00:14:bb32:5f00:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

78a22e968841df97d2a8f5f6150f98a563a711e6d4097962719837c18320f3b1

Security Headers

Name	Value
Content-Security-Policy	style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://heapanalytics.com; connect-src 'self' https://cdn.segment.com https://.ingest.sentry.io https://.hotjar.com https://.hotjar.io https://.huntr.dev https://.appsync-api.eu-west-1.amazonaws.com https://api.github.com https://api.bloggify.net https://heapanalytics.com https://api.segment.io wss://.hotjar.com https://app.posthog.com https://app.chatwoot.com; script-src 'self' 'unsafe-inline' https://browser.sentry-cdn.com https://cdn.heapanalytics.com https://heapanalytics.com https://*.hotjar.com https://app.chatwoot.com https://cdn.segment.com; font-src 'self' data: https://fonts.gstatic.com; child-src blob: https://www.youtube.com https://app.chatwoot.com https://vars.hotjar.com https://www.podbean.com;
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://huntr.dev/bounties/31ac0506-ae38-4128-a46d-71d5d079f8b7/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Wed, 21 Sep 2022 19:54:48 GMT
via: 1.1 a4a46c5a6cdf81ec1d08cf6e63389764.cloudfront.net (CloudFront)
x-content-type-options: nosniff
x-amz-cf-pop: FRA53-C1
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
content-length: 79
x-xss-protection: 1; mode=block
last-modified: Tue, 13 Sep 2022 20:42:55 GMT
server: AmazonS3
x-frame-options: SAMEORIGIN
etag: "11e86df8ac1d9c85f55c418a4fbf5255"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript
cache-control: public, max-age=0, s-maxage=600
content-security-policy: style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://heapanalytics.com; connect-src 'self' https://cdn.segment.com https://*.ingest.sentry.io https://*.hotjar.com https://*.hotjar.io https://*.huntr.dev https://*.appsync-api.eu-west-1.amazonaws.com https://api.github.com https://api.bloggify.net https://heapanalytics.com https://api.segment.io wss://*.hotjar.com https://app.posthog.com https://app.chatwoot.com; script-src 'self' 'unsafe-inline' https://browser.sentry-cdn.com https://cdn.heapanalytics.com https://heapanalytics.com https://*.hotjar.com https://app.chatwoot.com https://cdn.segment.com; font-src 'self' data: https://fonts.gstatic.com; child-src blob: https://www.youtube.com https://app.chatwoot.com https://vars.hotjar.com https://www.podbean.com;
accept-ranges: bytes
x-amz-cf-id: V6ybBHm0j_AH9on7wTve2nsjHTrF4ohuwQHYWOKI4tJiMuAyOv_Ohw==

GET
H2 200 870.bundle.323974846b6d45afb45e.js Show response
cdn.segment.com/analytics-next/bundles/ 17 KB
5 KB 44ms
44ms Script
application/javascript 13.225.79.112
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.segment.com/analytics-next/bundles/870.bundle.323974846b6d45afb45e.js
Requested by: Host: cdn.segment.com
URL: https://cdn.segment.com/analytics.js/v1/VWwEgATDMwku1jvgt0soCRaORr8xbOyx/analytics.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.79.112 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-79-112.fra2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 85fa85cbca5efaa81351f2e9b1e8e53916644bff91da6ffc762a151247501ebc

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://huntr.dev/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Sat, 27 Aug 2022 01:38:35 GMT
content-encoding: br
vary: Accept-Encoding
age: 2225773
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
access-control-allow-origin: *
last-modified: Fri, 26 Aug 2022 03:04:21 GMT
server: AmazonS3
etag: W/"d471f2a8b801a51bbc09c91b3f90b749"
access-control-max-age: 3000
access-control-allow-methods: GET, HEAD
x-amz-version-id: qltndKW7QqDrf8ZSZrei2HuGEvEC2x.O
via: 1.1 edfd22ec6695cdc9d7ac634220af1314.cloudfront.net (CloudFront)
cache-control: public,max-age=31536000,immutable
x-amz-cf-pop: FRA2-C2
content-type: application/javascript
x-amz-cf-id: _45yBFW-a6do-ItlC_bhGl7iEbnCD2yC_w7ux7FjPW8soDD_FIoeRA==

GET
H2 200 ajs-destination.bundle.35a8f6f19959bf2f455f.js Show response
cdn.segment.com/analytics-next/bundles/ 10 KB
4 KB 47ms
47ms Script
application/javascript 13.225.79.112
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.segment.com/analytics-next/bundles/ajs-destination.bundle.35a8f6f19959bf2f455f.js
Requested by: Host: cdn.segment.com
URL: https://cdn.segment.com/analytics.js/v1/VWwEgATDMwku1jvgt0soCRaORr8xbOyx/analytics.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.79.112 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-79-112.fra2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 9abdea148f6bb2fd5f4d3a947661b46f077584cfc3691deb29fa7cb25d2e00a6

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://huntr.dev/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Thu, 01 Sep 2022 06:12:31 GMT
content-encoding: br
vary: Accept-Encoding
age: 1777337
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
access-control-allow-origin: *
last-modified: Tue, 30 Aug 2022 21:47:48 GMT
server: AmazonS3
etag: W/"e0f89f667fb8d2b50aa8e29a86a4c9b1"
access-control-max-age: 3000
access-control-allow-methods: GET, HEAD
x-amz-version-id: 1ps0Y.cQfeUJnD6vrqu.rtfMUGfr8v9x
via: 1.1 edfd22ec6695cdc9d7ac634220af1314.cloudfront.net (CloudFront)
cache-control: public,max-age=31536000,immutable
x-amz-cf-pop: FRA2-C2
content-type: application/javascript
x-amz-cf-id: zD60bKMBDFshf5KQYyeRQNHuqoZ579ZMOLrxrrQ8QYXq7hYU02Bddw==

GET
H2 200 schemaFilter.bundle.debb169c1abb431faaa6.js Show response
cdn.segment.com/analytics-next/bundles/ 2 KB
1 KB 40ms
38ms Script
application/javascript 13.225.79.112
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.segment.com/analytics-next/bundles/schemaFilter.bundle.debb169c1abb431faaa6.js
Requested by: Host: cdn.segment.com
URL: https://cdn.segment.com/analytics.js/v1/VWwEgATDMwku1jvgt0soCRaORr8xbOyx/analytics.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.79.112 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-79-112.fra2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e8771b238c60c36fc935fd2dad0aed6e70cea50a635ff4f89f394a968a258c42

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://huntr.dev/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Sat, 30 Jul 2022 15:59:56 GMT
content-encoding: br
vary: Accept-Encoding
age: 4593292
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
access-control-allow-origin: *
last-modified: Thu, 28 Jul 2022 21:17:25 GMT
server: AmazonS3
etag: W/"3e448afdfea355c0f19700d04431ce7d"
access-control-max-age: 3000
access-control-allow-methods: GET, HEAD
x-amz-version-id: bdGJW00hoMEULfpND6wyp6DIUgkdrIDO
via: 1.1 edfd22ec6695cdc9d7ac634220af1314.cloudfront.net (CloudFront)
cache-control: public,max-age=31536000,immutable
x-amz-cf-pop: FRA2-C2
content-type: application/javascript
x-amz-cf-id: MYQCqnrUxF0Z5t4WTYlypNCOBQ9bl1dmi0iZdPovxWjL5KGba9Xv2w==

GET
H2 200 hotjar.dynamic.js.gz Show response
cdn.segment.com/next-integrations/integrations/hotjar/1.4.0/ 3 KB
2 KB 38ms
37ms Script
application/javascript 13.225.79.112
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.segment.com/next-integrations/integrations/hotjar/1.4.0/hotjar.dynamic.js.gz
Requested by: Host: cdn.segment.com
URL: https://cdn.segment.com/analytics.js/v1/VWwEgATDMwku1jvgt0soCRaORr8xbOyx/analytics.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.79.112 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-79-112.fra2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 05cee74e08992e6f58bc28d43ff042c5def119ba66ca7601cdb4b3efce53625f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://huntr.dev/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 13 Sep 2022 11:07:34 GMT
content-encoding: gzip
age: 722834
x-cache: Hit from cloudfront
content-length: 1336
access-control-allow-origin: *
last-modified: Fri, 09 Sep 2022 18:41:03 GMT
server: AmazonS3
etag: "4cd7c93a55ce331d264d9a857bd044ed"
access-control-max-age: 3000
access-control-allow-methods: GET, HEAD
x-amz-version-id: eVmGj6lwXFsdEBGhKD9CJz2h_tWyzO1w
via: 1.1 edfd22ec6695cdc9d7ac634220af1314.cloudfront.net (CloudFront)
cache-control: public,max-age=31536000,immutable
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: vVM2Hj2jc6krRKtuNQ-AjIPymgN6vapkZjsWr1Sd-SDPd2FKw5Ig5w==

GET
H2 200 sentry.dynamic.js.gz Show response
cdn.segment.com/next-integrations/integrations/sentry/3.0.1/ 4 KB
2 KB 38ms
38ms Script
application/javascript 13.225.79.112
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.segment.com/next-integrations/integrations/sentry/3.0.1/sentry.dynamic.js.gz
Requested by: Host: cdn.segment.com
URL: https://cdn.segment.com/analytics.js/v1/VWwEgATDMwku1jvgt0soCRaORr8xbOyx/analytics.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.79.112 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-79-112.fra2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: bb918e4772434c8678a69a4d9c1683e0ccf4bc2498f5240d1465b8287d2387cb

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://huntr.dev/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 13 Sep 2022 17:03:55 GMT
content-encoding: gzip
age: 701453
x-cache: Hit from cloudfront
content-length: 1635
access-control-allow-origin: *
last-modified: Fri, 09 Sep 2022 18:41:04 GMT
server: AmazonS3
etag: "ddd169ee2d3b58407ac01df09d8dbdc7"
access-control-max-age: 3000
access-control-allow-methods: GET, HEAD
x-amz-version-id: pOBp8sbK2xGlH4IR29KODgOsQrwVNkkh
via: 1.1 edfd22ec6695cdc9d7ac634220af1314.cloudfront.net (CloudFront)
cache-control: public,max-age=31536000,immutable
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: xT7Djvwx1FuZhqQzVt3Q5VAWZvsLMPKB0zbTVi_UNKtRUAtZHMOI_w==

GET
H2 200 commons.c42222c4cb2f8913500f.js.gz Show response
cdn.segment.com/next-integrations/integrations/vendor/ 73 KB
22 KB 43ms
43ms Script
application/javascript 13.225.79.112
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.segment.com/next-integrations/integrations/vendor/commons.c42222c4cb2f8913500f.js.gz
Requested by: Host: cdn.segment.com
URL: https://cdn.segment.com/analytics.js/v1/VWwEgATDMwku1jvgt0soCRaORr8xbOyx/analytics.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.79.112 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-79-112.fra2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: b17b4a5cc840a366a4c006794502f887a316402f781f85e913ac4af19a93fc13

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://huntr.dev/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 13 Sep 2022 19:07:57 GMT
content-encoding: gzip
age: 694010
x-cache: Hit from cloudfront
content-length: 22177
access-control-allow-origin: *
last-modified: Fri, 09 Sep 2022 18:41:00 GMT
server: AmazonS3
etag: "befb217271e2e926c7d898f1c85f6cb7"
access-control-max-age: 3000
access-control-allow-methods: GET, HEAD
x-amz-version-id: tXP_.JCtnIHvOWplpNdhbzU0oYjwn_PE
via: 1.1 edfd22ec6695cdc9d7ac634220af1314.cloudfront.net (CloudFront)
cache-control: public,max-age=31536000,immutable
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: _zVk2VljWnHaL1BPo8s03b4eG7YUVFvB4e9h_VE5XvhpK4pU-IpCwA==

GET
H/1.1 200
OK widget Show response
app.chatwoot.com/ Frame 0446 6 KB
7 KB 184ms
184ms Document
text/html 54.237.133.81
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://app.chatwoot.com/widget?website_token=puTnMCiAd9DHeNuoWk2mzm6X

Requested by

Host: app.chatwoot.com
URL: https://app.chatwoot.com/packs/js/sdk.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

54.237.133.81 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-237-133-81.compute-1.amazonaws.com

Software

Cowboy /

Resource Hash

af8ab56dd2f180b6a916aa1c0775bed78d84c2d522300f0cf422e57552024960

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://huntr.dev/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: max-age=0, private, must-revalidate
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Date: Wed, 21 Sep 2022 19:54:47 GMT
Etag: W/"af8ab56dd2f180b6a916aa1c0775bed7"
Referrer-Policy: strict-origin-when-cross-origin
Server: Cowboy
Strict-Transport-Security: max-age=63072000; includeSubDomains
Transfer-Encoding: chunked
Via: 1.1 vegur
X-Content-Type-Options: nosniff
X-Download-Options: noopen
X-Permitted-Cross-Domain-Policies: none
X-Request-Id: f28fcb18-5ea5-4e12-9cd5-ea1019332e27
X-Runtime: 0.051626
X-Xss-Protection: 1; mode=block

GET
H2 200 hotjar-2380708.js Show response
static.hotjar.com/c/ 11 KB
4 KB 183ms
42ms Script
application/javascript 18.66.97.53
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://static.hotjar.com/c/hotjar-2380708.js?sv=6

Requested by

Host: cdn.segment.com
URL: https://cdn.segment.com/next-integrations/integrations/hotjar/1.4.0/hotjar.dynamic.js.gz

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.97.53 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-66-97-53.fra56.r.cloudfront.net

Software

Resource Hash

f01cfc989119bf358354bd3789ec028284e9f9be6b5edcfd73fc3f5603e1c942

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://huntr.dev/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

strict-transport-security: max-age=604800; includeSubDomains
content-encoding: br
x-content-type-options: nosniff
age: 3
x-cache: Hit from cloudfront
date: Wed, 21 Sep 2022 19:54:44 GMT
cross-origin-resource-policy: cross-origin
via: 1.1 cb4c4a25e4ef534686959996782c8476.cloudfront.net (CloudFront)
cache-control: max-age=60
etag: W/1897ad059a52bf15fe67abf090cf56ec
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
x-generation-timing: 0
x-cache-hit: 1
x-amz-cf-pop: FRA56-P2
x-amz-cf-id: FuKVNlopofwjDmSzBBEy7OMouc2XEKCkUeMTdnfIqP6sDDQ2v6Bdfg==

GET
H2 200 bundle.min.js Show response
browser.sentry-cdn.com/5.12.1/ 55 KB
17 KB 127ms
39ms Script
application/javascript 2a04:4e42:200::729
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://browser.sentry-cdn.com/5.12.1/bundle.min.js

Requested by

Host: cdn.segment.com
URL: https://cdn.segment.com/next-integrations/integrations/vendor/commons.c42222c4cb2f8913500f.js.gz

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:200::729 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Fastly /

Resource Hash

75457b054e6e1e89f10dda4b777d5676404acaa1541618f03d4ed055a3857e05

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://huntr.dev/
Origin: https://huntr.dev
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Wed, 21 Sep 2022 19:54:47 GMT
content-encoding: gzip
last-modified: Tue, 04 Feb 2020 11:19:05 GMT
server: Fastly
age: 16374967
etag: "1c5228c89d281d08aa0ce908f582609a"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
strict-transport-security: max-age=31536000; includeSubDomains
accept-ranges: bytes
content-length: 17201
expires: Thu, 16 Mar 2023 07:18:39 GMT

POST
H2 200 p Show response
api.segment.io/v1/ 21 B
170 B 619ms
201ms Fetch
application/json 52.11.123.128
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api.segment.io/v1/p

Requested by

Host: cdn.segment.com
URL: https://cdn.segment.com/analytics.js/v1/VWwEgATDMwku1jvgt0soCRaORr8xbOyx/analytics.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.11.123.128 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-11-123-128.us-west-2.compute.amazonaws.com

Software

Resource Hash

12f71cb993958eefc4bdb41d7dbbda490779a9c7aba448f7be52bb63912e0254

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://huntr.dev/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://huntr.dev
date: Wed, 21 Sep 2022 19:54:48 GMT
strict-transport-security: max-age=31536000
content-length: 21
vary: Origin
content-type: application/json

GET
H2 200 rewriteframes.min.js Show response
browser.sentry-cdn.com/5.12.1/ 5 KB
2 KB 39ms
38ms Script
application/javascript 2a04:4e42:200::729
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://browser.sentry-cdn.com/5.12.1/rewriteframes.min.js

Requested by

Host: cdn.segment.com
URL: https://cdn.segment.com/next-integrations/integrations/vendor/commons.c42222c4cb2f8913500f.js.gz

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:200::729 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Fastly /

Resource Hash

93a1f3263e3c883f998ff8f4a3fd8afc3066f33daf90248b89e2bb01cd2003f7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://huntr.dev/
Origin: https://huntr.dev
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Wed, 21 Sep 2022 19:54:47 GMT
content-encoding: gzip
last-modified: Tue, 04 Feb 2020 11:19:05 GMT
server: Fastly
age: 3064341
etag: "4e240097ab71acf709caa48e23cd6411"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
strict-transport-security: max-age=31536000; includeSubDomains
accept-ranges: bytes
content-length: 1807
expires: Mon, 22 Aug 2022 07:32:08 GMT

OPTIONS
H2 200 graphql
mnk2smepzzdp5djxpbthzr6odq.appsync-api.eu-west-1.amazonaws.com/ Frame 0
0 110ms
110ms Preflight 52.222.236.16
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://mnk2smepzzdp5djxpbthzr6odq.appsync-api.eu-west-1.amazonaws.com/graphql
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.236.16 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-236-16.fra56.r.cloudfront.net
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type,x-api-key
Access-Control-Request-Method: POST
Origin: https://huntr.dev
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

access-control-allow-headers: content-type,x-api-key
access-control-allow-methods: POST
access-control-allow-origin: *
access-control-expose-headers: x-amzn-RequestId,x-amzn-ErrorType,x-amz-user-agent,x-amzn-ErrorMessage,Date,x-amz-schema-version
access-control-max-age: 172800
content-length: 0
date: Wed, 21 Sep 2022 19:54:48 GMT
via: 1.1 ce765e91525a836efb6bc0a409334a5e.cloudfront.net (CloudFront)
x-amz-cf-id: FGgFLJMkC0A5FnYeRjPmugguKNJk6isRCeDZJZhQZJWbqzUhEMhsrA==
x-amz-cf-pop: FRA56-P4
x-amzn-requestid: 30810a75-ad4f-4daa-a555-5a6c7a55edd7
x-cache: Miss from cloudfront

OPTIONS
H2 200 graphql
mnk2smepzzdp5djxpbthzr6odq.appsync-api.eu-west-1.amazonaws.com/ Frame 0
0 113ms
113ms Preflight 52.222.236.16
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://mnk2smepzzdp5djxpbthzr6odq.appsync-api.eu-west-1.amazonaws.com/graphql
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.236.16 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-236-16.fra56.r.cloudfront.net
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type,x-api-key
Access-Control-Request-Method: POST
Origin: https://huntr.dev
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

access-control-allow-headers: content-type,x-api-key
access-control-allow-methods: POST
access-control-allow-origin: *
access-control-expose-headers: x-amzn-RequestId,x-amzn-ErrorType,x-amz-user-agent,x-amzn-ErrorMessage,Date,x-amz-schema-version
access-control-max-age: 172800
content-length: 0
date: Wed, 21 Sep 2022 19:54:48 GMT
via: 1.1 ce765e91525a836efb6bc0a409334a5e.cloudfront.net (CloudFront)
x-amz-cf-id: 0V7l1pr8jEfhTP1K6fH7Y2z2FyvCZJNNx0J6SsMuRgvtm_ict-s6Jw==
x-amz-cf-pop: FRA56-P4
x-amzn-requestid: 24e9d58b-b36b-45cb-b555-1d843b39d4cf
x-cache: Miss from cloudfront

OPTIONS
H2 200 graphql
mnk2smepzzdp5djxpbthzr6odq.appsync-api.eu-west-1.amazonaws.com/ Frame 0
0 110ms
109ms Preflight 52.222.236.16
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://mnk2smepzzdp5djxpbthzr6odq.appsync-api.eu-west-1.amazonaws.com/graphql
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.236.16 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-236-16.fra56.r.cloudfront.net
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type,x-api-key
Access-Control-Request-Method: POST
Origin: https://huntr.dev
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

access-control-allow-headers: content-type,x-api-key
access-control-allow-methods: POST
access-control-allow-origin: *
access-control-expose-headers: x-amzn-RequestId,x-amzn-ErrorType,x-amz-user-agent,x-amzn-ErrorMessage,Date,x-amz-schema-version
access-control-max-age: 172800
content-length: 0
date: Wed, 21 Sep 2022 19:54:48 GMT
via: 1.1 ce765e91525a836efb6bc0a409334a5e.cloudfront.net (CloudFront)
x-amz-cf-id: ekqFOSFpvPdswDCARh-_spxeVh8P84Zwm20uih0s62jt0R57Y2JAPg==
x-amz-cf-pop: FRA56-P4
x-amzn-requestid: 6c047855-129c-4511-aae6-2014675e1490
x-cache: Miss from cloudfront

OPTIONS
H2 200 graphql
mnk2smepzzdp5djxpbthzr6odq.appsync-api.eu-west-1.amazonaws.com/ Frame 0
0 114ms
113ms Preflight 52.222.236.16
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://mnk2smepzzdp5djxpbthzr6odq.appsync-api.eu-west-1.amazonaws.com/graphql
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.236.16 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-236-16.fra56.r.cloudfront.net
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type,x-api-key
Access-Control-Request-Method: POST
Origin: https://huntr.dev
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

access-control-allow-headers: content-type,x-api-key
access-control-allow-methods: POST
access-control-allow-origin: *
access-control-expose-headers: x-amzn-RequestId,x-amzn-ErrorType,x-amz-user-agent,x-amzn-ErrorMessage,Date,x-amz-schema-version
access-control-max-age: 172800
content-length: 0
date: Wed, 21 Sep 2022 19:54:48 GMT
via: 1.1 ce765e91525a836efb6bc0a409334a5e.cloudfront.net (CloudFront)
x-amz-cf-id: jHfYxr-p6MmMn2Od0GSlWj3kKmerMqVEmTvnuTehWUWxUVFpIPIyXg==
x-amz-cf-pop: FRA56-P4
x-amzn-requestid: 3bfee502-b7f6-4121-9bd8-5ee408b73ed6
x-cache: Miss from cloudfront

GET
H2 200 AJc5JmRVrISc9-r8v7PBLiduVGQo-jPUrGvWQIUeOLG3vM8Vxz3IHRpoXi645b6Y0ZSBiMSpG8-Dch8=w1920-h937
lh3.googleusercontent.com/drive-viewer/ 248 KB
248 KB 337ms
255ms Image
image/png 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh3.googleusercontent.com/drive-viewer/AJc5JmRVrISc9-r8v7PBLiduVGQo-jPUrGvWQIUeOLG3vM8Vxz3IHRpoXi645b6Y0ZSBiMSpG8-Dch8=w1920-h937

Requested by

Host: huntr.dev
URL: https://huntr.dev/bounties/31ac0506-ae38-4128-a46d-71d5d079f8b7/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

d08741c1171a2f3fc784af466ef82071a611b1b30092b78b2ac23d575ba2b345

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://huntr.dev/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Wed, 21 Sep 2022 19:54:48 GMT
x-content-type-options: nosniff
server: fife
etag: "v2"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: private, max-age=86400, no-transform
content-disposition: inline;filename="xss.png"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 253827
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 php_elephant.5d71f8d.svg
huntr.dev/_nuxt/img/ 3 KB
2 KB 127ms
127ms Image
image/svg+xml 2600:9000:214f:9c00:14:bb32:5f00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://huntr.dev/_nuxt/img/php_elephant.5d71f8d.svg

Requested by

Host: huntr.dev
URL: https://huntr.dev/bounties/31ac0506-ae38-4128-a46d-71d5d079f8b7/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:214f:9c00:14:bb32:5f00:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

ab513161359bcd805d8df2ae160b0064edcdc60f914ac3f0bac697f2979bfd1e

Security Headers

Name	Value
Content-Security-Policy	style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://heapanalytics.com; connect-src 'self' https://cdn.segment.com https://.ingest.sentry.io https://.hotjar.com https://.hotjar.io https://.huntr.dev https://.appsync-api.eu-west-1.amazonaws.com https://api.github.com https://api.bloggify.net https://heapanalytics.com https://api.segment.io wss://.hotjar.com https://app.posthog.com https://app.chatwoot.com; script-src 'self' 'unsafe-inline' https://browser.sentry-cdn.com https://cdn.heapanalytics.com https://heapanalytics.com https://*.hotjar.com https://app.chatwoot.com https://cdn.segment.com; font-src 'self' data: https://fonts.gstatic.com; child-src blob: https://www.youtube.com https://app.chatwoot.com https://vars.hotjar.com https://www.podbean.com;
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://huntr.dev/bounties/31ac0506-ae38-4128-a46d-71d5d079f8b7/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Wed, 21 Sep 2022 19:54:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-amz-cf-pop: FRA53-C1
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
vary: Accept-Encoding
x-xss-protection: 1; mode=block
last-modified: Tue, 13 Sep 2022 20:42:42 GMT
server: AmazonS3
x-frame-options: SAMEORIGIN
etag: W/"f4fa9b2257b2973619f471612924a977"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/svg+xml
via: 1.1 a4a46c5a6cdf81ec1d08cf6e63389764.cloudfront.net (CloudFront)
cache-control: public, max-age=0, s-maxage=600
content-security-policy: style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://heapanalytics.com; connect-src 'self' https://cdn.segment.com https://*.ingest.sentry.io https://*.hotjar.com https://*.hotjar.io https://*.huntr.dev https://*.appsync-api.eu-west-1.amazonaws.com https://api.github.com https://api.bloggify.net https://heapanalytics.com https://api.segment.io wss://*.hotjar.com https://app.posthog.com https://app.chatwoot.com; script-src 'self' 'unsafe-inline' https://browser.sentry-cdn.com https://cdn.heapanalytics.com https://heapanalytics.com https://*.hotjar.com https://app.chatwoot.com https://cdn.segment.com; font-src 'self' data: https://fonts.gstatic.com; child-src blob: https://www.youtube.com https://app.chatwoot.com https://vars.hotjar.com https://www.podbean.com;
x-amz-cf-id: 6ZuWaml-H9ZBMLyHJDtlk4LsOdfanXL3bD379_aEvy89SGBdDdi4QQ==

POST
H2 200 graphql Show response
mnk2smepzzdp5djxpbthzr6odq.appsync-api.eu-west-1.amazonaws.com/ 231 B
652 B 191ms
190ms XHR
application/json 52.222.236.16
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://mnk2smepzzdp5djxpbthzr6odq.appsync-api.eu-west-1.amazonaws.com/graphql
Requested by: Host: huntr.dev
URL: https://huntr.dev/_nuxt/06b2c2f.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.236.16 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-236-16.fra56.r.cloudfront.net
Software: /
Resource Hash: 6d099709adf0af21feb9ca7343511e99bab076ca5d1f4d92b7be276f81f3f029

Request headers

accept: */*
Referer: https://huntr.dev/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36
x-api-key: da2-fql7xoajcng6pilmew4lfbi6ga
content-type: application/json

Response headers

x-amzn-appsync-tokensconsumed: 1
date: Wed, 21 Sep 2022 19:54:48 GMT
via: 1.1 ce765e91525a836efb6bc0a409334a5e.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P4
x-amzn-requestid: 0e92f4af-185b-4ed5-aeda-6661303c1b1e
x-cache: Miss from cloudfront
content-type: application/json;charset=UTF-8
access-control-allow-origin: *
access-control-expose-headers: x-amzn-RequestId,x-amzn-ErrorType,x-amz-user-agent,x-amzn-ErrorMessage,Date,x-amz-schema-version
content-length: 231
x-amz-cf-id: iPjiYZ5H95VQNVmt0A6CbjcVxkKyNB_hp2Kd9lVO1AHf1zpDJEl28A==

POST
H2 200 graphql Show response
mnk2smepzzdp5djxpbthzr6odq.appsync-api.eu-west-1.amazonaws.com/ 8 KB
8 KB 457ms
457ms XHR
application/json 52.222.236.16
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://mnk2smepzzdp5djxpbthzr6odq.appsync-api.eu-west-1.amazonaws.com/graphql
Requested by: Host: huntr.dev
URL: https://huntr.dev/_nuxt/06b2c2f.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.236.16 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-236-16.fra56.r.cloudfront.net
Software: /
Resource Hash: a07884d0d9d5d56f50513c2aea835403cf50d7d9cb013883f80424daf7ef3701

Request headers

accept: */*
Referer: https://huntr.dev/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36
x-api-key: da2-fql7xoajcng6pilmew4lfbi6ga
content-type: application/json

Response headers

x-amzn-appsync-tokensconsumed: 5
date: Wed, 21 Sep 2022 19:54:48 GMT
via: 1.1 ce765e91525a836efb6bc0a409334a5e.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P4
x-amzn-requestid: a0ac25d6-9ac9-44e7-b6a9-0753557b5e2e
x-cache: Miss from cloudfront
content-type: application/json;charset=UTF-8
access-control-allow-origin: *
access-control-expose-headers: x-amzn-RequestId,x-amzn-ErrorType,x-amz-user-agent,x-amzn-ErrorMessage,Date,x-amz-schema-version
content-length: 8070
x-amz-cf-id: BXgAgYiluM_6nmYAKb_d0XPWnqvrJFaYtjCtV9tCZEkxftEQ37pl3Q==

POST
H2 200 graphql Show response
mnk2smepzzdp5djxpbthzr6odq.appsync-api.eu-west-1.amazonaws.com/ 713 B
1 KB 501ms
500ms XHR
application/json 52.222.236.16
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://mnk2smepzzdp5djxpbthzr6odq.appsync-api.eu-west-1.amazonaws.com/graphql
Requested by: Host: huntr.dev
URL: https://huntr.dev/_nuxt/06b2c2f.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.236.16 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-236-16.fra56.r.cloudfront.net
Software: /
Resource Hash: 5367a9ddcb66dcf346be2c8eaaefb73ab205869e8d1224967603eb6e28cf6a42

Request headers

accept: */*
Referer: https://huntr.dev/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36
x-api-key: da2-fql7xoajcng6pilmew4lfbi6ga
content-type: application/json

Response headers

x-amzn-appsync-tokensconsumed: 5
date: Wed, 21 Sep 2022 19:54:48 GMT
via: 1.1 ce765e91525a836efb6bc0a409334a5e.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P4
x-amzn-requestid: 8d5b01e9-b084-4ada-96a9-47df63b87793
x-cache: Miss from cloudfront
content-type: application/json;charset=UTF-8
access-control-allow-origin: *
access-control-expose-headers: x-amzn-RequestId,x-amzn-ErrorType,x-amz-user-agent,x-amzn-ErrorMessage,Date,x-amz-schema-version
content-length: 713
x-amz-cf-id: 1Em_azdbaSvqcuALG06QKzS6aOM9jb9j4FXArnJ_iJCADz40Vqx-NQ==

POST
H2 200 graphql Show response
mnk2smepzzdp5djxpbthzr6odq.appsync-api.eu-west-1.amazonaws.com/ 2 KB
3 KB 329ms
329ms XHR
application/json 52.222.236.16
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://mnk2smepzzdp5djxpbthzr6odq.appsync-api.eu-west-1.amazonaws.com/graphql
Requested by: Host: huntr.dev
URL: https://huntr.dev/_nuxt/06b2c2f.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.236.16 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-236-16.fra56.r.cloudfront.net
Software: /
Resource Hash: 1364fc71ab196d3eb6c9e1bb8c7ff592a0d225efc92e21caa21d96e79931448b

Request headers

accept: */*
Referer: https://huntr.dev/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36
x-api-key: da2-fql7xoajcng6pilmew4lfbi6ga
content-type: application/json

Response headers

x-amzn-appsync-tokensconsumed: 1
date: Wed, 21 Sep 2022 19:54:48 GMT
via: 1.1 ce765e91525a836efb6bc0a409334a5e.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P4
x-amzn-requestid: 3d583d98-8ada-4760-8c09-262c2fb2be09
x-cache: Miss from cloudfront
content-type: application/json;charset=UTF-8
access-control-allow-origin: *
access-control-expose-headers: x-amzn-RequestId,x-amzn-ErrorType,x-amz-user-agent,x-amzn-ErrorMessage,Date,x-amz-schema-version
content-length: 2318
x-amz-cf-id: B-AaePWaC8LKvf2jgYOiVcf_fxXvUR0dhOTx6T-Q1R54fN3sKLAmmg==

POST
H2 200 graphql Show response
mnk2smepzzdp5djxpbthzr6odq.appsync-api.eu-west-1.amazonaws.com/ 31 B
452 B 390ms
390ms XHR
application/json 52.222.236.16
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://mnk2smepzzdp5djxpbthzr6odq.appsync-api.eu-west-1.amazonaws.com/graphql
Requested by: Host: huntr.dev
URL: https://huntr.dev/_nuxt/06b2c2f.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.236.16 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-236-16.fra56.r.cloudfront.net
Software: /
Resource Hash: 917a1a36e4df34776ab68224439190e342ac6cb9b3697d51606a6b8c7d9271f6

Request headers

accept: */*
Referer: https://huntr.dev/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36
x-api-key: da2-fql7xoajcng6pilmew4lfbi6ga
content-type: application/json

Response headers

x-amzn-appsync-tokensconsumed: 4
date: Wed, 21 Sep 2022 19:54:48 GMT
via: 1.1 ce765e91525a836efb6bc0a409334a5e.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P4
x-amzn-requestid: 0a3bd69e-45e9-4cf8-8bfe-0584f7050243
x-cache: Miss from cloudfront
content-type: application/json;charset=UTF-8
access-control-allow-origin: *
access-control-expose-headers: x-amzn-RequestId,x-amzn-ErrorType,x-amz-user-agent,x-amzn-ErrorMessage,Date,x-amz-schema-version
content-length: 31
x-amz-cf-id: SjLjXVwBAl97UYQ-T9Td5BDxhMw8T1CypliyU7z6HH8k4nPpPlgLsg==

OPTIONS
H2 200 graphql
mnk2smepzzdp5djxpbthzr6odq.appsync-api.eu-west-1.amazonaws.com/ Frame 0
0 133ms
133ms Preflight 52.222.236.16
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://mnk2smepzzdp5djxpbthzr6odq.appsync-api.eu-west-1.amazonaws.com/graphql
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.236.16 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-236-16.fra56.r.cloudfront.net
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type,x-api-key
Access-Control-Request-Method: POST
Origin: https://huntr.dev
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

access-control-allow-headers: content-type,x-api-key
access-control-allow-methods: POST
access-control-allow-origin: *
access-control-expose-headers: x-amzn-RequestId,x-amzn-ErrorType,x-amz-user-agent,x-amzn-ErrorMessage,Date,x-amz-schema-version
access-control-max-age: 172800
content-length: 0
date: Wed, 21 Sep 2022 19:54:48 GMT
via: 1.1 ce765e91525a836efb6bc0a409334a5e.cloudfront.net (CloudFront)
x-amz-cf-id: 6nDKzctI0DMd1RGom7U-PiH-wOYWa93wH0mnSpk-dOTaKSeqwxIbCw==
x-amz-cf-pop: FRA56-P4
x-amzn-requestid: bdd048e8-9b00-4344-a213-610300b20128
x-cache: Miss from cloudfront

GET
H2 200 Metropolis-Regular.67a1988.otf
huntr.dev/_nuxt/fonts/ 23 KB
18 KB 124ms
124ms Font
font/otf 2600:9000:214f:9c00:14:bb32:5f00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://huntr.dev/_nuxt/fonts/Metropolis-Regular.67a1988.otf

Requested by

Host: huntr.dev
URL: https://huntr.dev/bounties/31ac0506-ae38-4128-a46d-71d5d079f8b7/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:214f:9c00:14:bb32:5f00:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

6f8992eb58eeced41efea7076be4d468ac678f9778420438fab4a3358aa2b462

Security Headers

Name	Value
Content-Security-Policy	style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://heapanalytics.com; connect-src 'self' https://cdn.segment.com https://.ingest.sentry.io https://.hotjar.com https://.hotjar.io https://.huntr.dev https://.appsync-api.eu-west-1.amazonaws.com https://api.github.com https://api.bloggify.net https://heapanalytics.com https://api.segment.io wss://.hotjar.com https://app.posthog.com https://app.chatwoot.com; script-src 'self' 'unsafe-inline' https://browser.sentry-cdn.com https://cdn.heapanalytics.com https://heapanalytics.com https://*.hotjar.com https://app.chatwoot.com https://cdn.segment.com; font-src 'self' data: https://fonts.gstatic.com; child-src blob: https://www.youtube.com https://app.chatwoot.com https://vars.hotjar.com https://www.podbean.com;
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://huntr.dev/bounties/31ac0506-ae38-4128-a46d-71d5d079f8b7/
Origin: https://huntr.dev
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Wed, 21 Sep 2022 19:54:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-amz-cf-pop: FRA53-C1
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
vary: Accept-Encoding
x-xss-protection: 1; mode=block
last-modified: Tue, 13 Sep 2022 20:42:30 GMT
server: AmazonS3
x-frame-options: SAMEORIGIN
etag: W/"f7b5e589f88206b4bd5cb1408c5362e6"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: font/otf
via: 1.1 a4a46c5a6cdf81ec1d08cf6e63389764.cloudfront.net (CloudFront)
cache-control: public, max-age=0, s-maxage=600
content-security-policy: style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://heapanalytics.com; connect-src 'self' https://cdn.segment.com https://*.ingest.sentry.io https://*.hotjar.com https://*.hotjar.io https://*.huntr.dev https://*.appsync-api.eu-west-1.amazonaws.com https://api.github.com https://api.bloggify.net https://heapanalytics.com https://api.segment.io wss://*.hotjar.com https://app.posthog.com https://app.chatwoot.com; script-src 'self' 'unsafe-inline' https://browser.sentry-cdn.com https://cdn.heapanalytics.com https://heapanalytics.com https://*.hotjar.com https://app.chatwoot.com https://cdn.segment.com; font-src 'self' data: https://fonts.gstatic.com; child-src blob: https://www.youtube.com https://app.chatwoot.com https://vars.hotjar.com https://www.podbean.com;
x-amz-cf-id: RetNYI0FFx0xAz-B7-OymxOHNzYiRBmWHlKI0xSEIQCdb5Zk1GyP5w==

GET
H2 200 widget-021fd02ded895d1ff570.js Show response
d3tq67kexc2w2i.cloudfront.net/packs/js/ Frame 0446 604 KB
168 KB 159ms
72ms Script
application/javascript 2600:9000:2240:ea00:7:dce7:b680:21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://d3tq67kexc2w2i.cloudfront.net/packs/js/widget-021fd02ded895d1ff570.js

Requested by

Host: app.chatwoot.com
URL: https://app.chatwoot.com/widget?website_token=puTnMCiAd9DHeNuoWk2mzm6X

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2240:ea00:7:dce7:b680:21 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Cowboy /

Resource Hash

78ee838ac4fcfc7978efd6ef8dff5bd0cbf96fba76b9c3e3a905ce4273d87bd4

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://app.chatwoot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Wed, 21 Sep 2022 01:36:56 GMT
content-encoding: gzip
last-modified: Wed, 21 Sep 2022 01:31:48 GMT
server: Cowboy
age: 65872
vary: Accept-Encoding,Origin
strict-transport-security: max-age=63072000; includeSubDomains
content-type: application/javascript
via: 1.1 vegur, 1.1 75a13c74495137fb5435dc4030981df6.cloudfront.net (CloudFront)
cache-control: public, max-age=31556952
x-cache: Hit from cloudfront
x-amz-cf-pop: FRA60-P1
content-length: 171853
x-amz-cf-id: siU4gETN94mBZhe8sm1iM938Wud3SVO0yqq4VQ1U1LridtB0zO7Jqg==

GET
H2 200 widget-62de3f31.css
d3tq67kexc2w2i.cloudfront.net/packs/css/ Frame 0446 112 KB
16 KB 131ms
45ms Stylesheet
text/css 2600:9000:2240:ea00:7:dce7:b680:21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://d3tq67kexc2w2i.cloudfront.net/packs/css/widget-62de3f31.css

Requested by

Host: app.chatwoot.com
URL: https://app.chatwoot.com/widget?website_token=puTnMCiAd9DHeNuoWk2mzm6X

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2240:ea00:7:dce7:b680:21 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Cowboy /

Resource Hash

56adfe951f03977fd032e10949aa48014ea7e01057d364b5af625c4d27e2a14d

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://app.chatwoot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Wed, 21 Sep 2022 01:36:53 GMT
content-encoding: gzip
last-modified: Wed, 21 Sep 2022 01:31:48 GMT
server: Cowboy
age: 65875
vary: Accept-Encoding,Origin
strict-transport-security: max-age=63072000; includeSubDomains
content-type: text/css
via: 1.1 vegur, 1.1 75a13c74495137fb5435dc4030981df6.cloudfront.net (CloudFront)
cache-control: public, max-age=31556952
x-cache: Hit from cloudfront
x-amz-cf-pop: FRA60-P1
content-length: 15668
x-amz-cf-id: Qa99aGH6l_ACBUkB0UykzgKwho5yjZwDMb3Z-Q8R9RNrT1DjIGy8Tg==

GET
H2 200 modules.f4179535429bf14e77ee.js Show response
script.hotjar.com/ 252 KB
64 KB 120ms
44ms Script
application/javascript 52.222.236.43
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://script.hotjar.com/modules.f4179535429bf14e77ee.js

Requested by

Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-2380708.js?sv=6

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.236.43 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-222-236-43.fra56.r.cloudfront.net

Software

Resource Hash

54502058e97eaac693950652b3243bf71346305b1b3c5a2fa479c27dd8d5a73f

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://huntr.dev/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 20 Sep 2022 16:01:07 GMT
content-encoding: br
x-content-type-options: nosniff
age: 100421
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=604800; includeSubDomains
content-length: 65420
access-control-allow-origin: *
last-modified: Tue, 20 Sep 2022 16:00:26 GMT
etag: "4a99ec558aff503901b33da3d9b4ec1b"
vary: Accept-Encoding
content-type: application/javascript
via: 1.1 944dc31277adc1021b0776fe818f07f6.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: FRA56-P4
accept-ranges: bytes
x-robots-tag: none
x-amz-cf-id: E9w5dJ2AnweFwuTjJU9ZwdxBRaKBLV6XYkO-pNRuGP9ncAErmOEo3g==

GET
H2 200 53eae28.js Show response
huntr.dev/_nuxt/ 50 KB
14 KB 107ms
107ms Script
application/javascript 2600:9000:214f:9c00:14:bb32:5f00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://huntr.dev/_nuxt/53eae28.js

Requested by

Host: huntr.dev
URL: https://huntr.dev/_nuxt/2c71194.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:214f:9c00:14:bb32:5f00:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

22c9554b30b2d88619261c7ea4ed2c95db567cf3be83f5ea2cbb2087043e2c7b

Security Headers

Name	Value
Content-Security-Policy	style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://heapanalytics.com; connect-src 'self' https://cdn.segment.com https://.ingest.sentry.io https://.hotjar.com https://.hotjar.io https://.huntr.dev https://.appsync-api.eu-west-1.amazonaws.com https://api.github.com https://api.bloggify.net https://heapanalytics.com https://api.segment.io wss://.hotjar.com https://app.posthog.com https://app.chatwoot.com; script-src 'self' 'unsafe-inline' https://browser.sentry-cdn.com https://cdn.heapanalytics.com https://heapanalytics.com https://*.hotjar.com https://app.chatwoot.com https://cdn.segment.com; font-src 'self' data: https://fonts.gstatic.com; child-src blob: https://www.youtube.com https://app.chatwoot.com https://vars.hotjar.com https://www.podbean.com;
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://huntr.dev/bounties/31ac0506-ae38-4128-a46d-71d5d079f8b7/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Wed, 21 Sep 2022 19:54:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-amz-cf-pop: FRA53-C1
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
vary: Accept-Encoding
x-xss-protection: 1; mode=block
last-modified: Tue, 13 Sep 2022 20:42:30 GMT
server: AmazonS3
x-frame-options: SAMEORIGIN
etag: W/"e03415387b7aa4d015980949900091f3"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript
via: 1.1 a4a46c5a6cdf81ec1d08cf6e63389764.cloudfront.net (CloudFront)
cache-control: public, max-age=0, s-maxage=600
content-security-policy: style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://heapanalytics.com; connect-src 'self' https://cdn.segment.com https://*.ingest.sentry.io https://*.hotjar.com https://*.hotjar.io https://*.huntr.dev https://*.appsync-api.eu-west-1.amazonaws.com https://api.github.com https://api.bloggify.net https://heapanalytics.com https://api.segment.io wss://*.hotjar.com https://app.posthog.com https://app.chatwoot.com; script-src 'self' 'unsafe-inline' https://browser.sentry-cdn.com https://cdn.heapanalytics.com https://heapanalytics.com https://*.hotjar.com https://app.chatwoot.com https://cdn.segment.com; font-src 'self' data: https://fonts.gstatic.com; child-src blob: https://www.youtube.com https://app.chatwoot.com https://vars.hotjar.com https://www.podbean.com;
x-amz-cf-id: cYffgUQz0oSdliL7bI470XaOByUbSeiZTHv41g2PnCm-MlC0HxwHpg==

GET
H2 200 payload.js Show response
huntr.dev/_nuxt/static/1663100578/repos/pimcore/pimcore/ 211 B
1 KB 125ms
125ms Script
application/javascript 2600:9000:214f:9c00:14:bb32:5f00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://huntr.dev/_nuxt/static/1663100578/repos/pimcore/pimcore/payload.js

Requested by

Host: huntr.dev
URL: https://huntr.dev/_nuxt/06b2c2f.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:214f:9c00:14:bb32:5f00:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

f4e461a88507fc83bc4732d7cec7b9e28b3f44e8ee5e25de73d4a877dcf58c79

Security Headers

Name	Value
Content-Security-Policy	style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://heapanalytics.com; connect-src 'self' https://cdn.segment.com https://.ingest.sentry.io https://.hotjar.com https://.hotjar.io https://.huntr.dev https://.appsync-api.eu-west-1.amazonaws.com https://api.github.com https://api.bloggify.net https://heapanalytics.com https://api.segment.io wss://.hotjar.com https://app.posthog.com https://app.chatwoot.com; script-src 'self' 'unsafe-inline' https://browser.sentry-cdn.com https://cdn.heapanalytics.com https://heapanalytics.com https://*.hotjar.com https://app.chatwoot.com https://cdn.segment.com; font-src 'self' data: https://fonts.gstatic.com; child-src blob: https://www.youtube.com https://app.chatwoot.com https://vars.hotjar.com https://www.podbean.com;
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://huntr.dev/bounties/31ac0506-ae38-4128-a46d-71d5d079f8b7/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Wed, 21 Sep 2022 19:54:49 GMT
via: 1.1 a4a46c5a6cdf81ec1d08cf6e63389764.cloudfront.net (CloudFront)
x-content-type-options: nosniff
x-amz-cf-pop: FRA53-C1
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
content-length: 211
x-xss-protection: 1; mode=block
last-modified: Tue, 13 Sep 2022 20:42:57 GMT
server: AmazonS3
x-frame-options: SAMEORIGIN
etag: "2cbd94ed9e3f5c267e02114fa30a17f2"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript
cache-control: public, max-age=0, s-maxage=600
content-security-policy: style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://heapanalytics.com; connect-src 'self' https://cdn.segment.com https://*.ingest.sentry.io https://*.hotjar.com https://*.hotjar.io https://*.huntr.dev https://*.appsync-api.eu-west-1.amazonaws.com https://api.github.com https://api.bloggify.net https://heapanalytics.com https://api.segment.io wss://*.hotjar.com https://app.posthog.com https://app.chatwoot.com; script-src 'self' 'unsafe-inline' https://browser.sentry-cdn.com https://cdn.heapanalytics.com https://heapanalytics.com https://*.hotjar.com https://app.chatwoot.com https://cdn.segment.com; font-src 'self' data: https://fonts.gstatic.com; child-src blob: https://www.youtube.com https://app.chatwoot.com https://vars.hotjar.com https://www.podbean.com;
accept-ranges: bytes
x-amz-cf-id: rZjkbVbba_jod4Czvs7kmSW-Clb4i1cgiZIsqGnZqACPxJ1KC84m1w==

GET
H2 200 box-69edcc3187336f9b0a3fbb4c73be9fe6.html Show response
vars.hotjar.com/ Frame B94B 2 KB
1 KB 150ms
49ms Document
text/html 65.9.44.23
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://vars.hotjar.com/box-69edcc3187336f9b0a3fbb4c73be9fe6.html

Requested by

Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-2380708.js?sv=6

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

65.9.44.23 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-65-9-44-23.arn54.r.cloudfront.net

Software

Resource Hash

867b23a408fa99143955de5665345cda886857174c328d2828e5dcd33bd98cd1

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800; includeSubDomains

Request headers

Referer: https://huntr.dev/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 1247861
cache-control: max-age=31536000
content-encoding: br
content-length: 1044
content-type: text/html
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Wed, 07 Sep 2022 09:17:07 GMT
etag: "f6a9ca04b0687ea3c0d98e8430c8c77b"
last-modified: Wed, 07 Sep 2022 09:16:57 GMT
strict-transport-security: max-age=604800; includeSubDomains
vary: Accept-Encoding
via: 1.1 0dbf67e262a6295e9e8f6570f9aae7e0.cloudfront.net (CloudFront)
x-amz-cf-id: BbzJCpZUlx-u0_IuBCPMC_xM4KkOLWibWbr3pJG1YYynJU8utqovuw==
x-amz-cf-pop: ARN54-C1
x-cache: Hit from cloudfront
x-robots-tag: none

POST
H2 200 visit-data Show response
in.hotjar.com/api/v2/client/sites/2380708/ 148 B
322 B 170ms
59ms XHR
application/json 52.30.157.40
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://in.hotjar.com/api/v2/client/sites/2380708/visit-data?sv=6
Requested by: Host: browser.sentry-cdn.com
URL: https://browser.sentry-cdn.com/5.12.1/bundle.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.30.157.40 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-30-157-40.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 46354f041f1d15b2ef3ae63228cb7116fa498f180ea9e49e442f1a561aedf7d2

Request headers

Referer: https://huntr.dev/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36
Content-Type: text/plain; charset=UTF-8

Response headers

date: Wed, 21 Sep 2022 19:54:48 GMT
content-encoding: br
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
access-control-max-age: 86400
cache-control: no-cache, no-store
access-control-allow-credentials: true

GET
H2 200 14-ed94cc2d.chunk.css
d3tq67kexc2w2i.cloudfront.net/packs/css/ Frame 0446 1 KB
863 B 37ms
37ms Stylesheet
text/css 2600:9000:2240:ea00:7:dce7:b680:21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://d3tq67kexc2w2i.cloudfront.net/packs/css/14-ed94cc2d.chunk.css

Requested by

Host: d3tq67kexc2w2i.cloudfront.net
URL: https://d3tq67kexc2w2i.cloudfront.net/packs/js/widget-021fd02ded895d1ff570.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2240:ea00:7:dce7:b680:21 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Cowboy /

Resource Hash

30911cb2d9e297e499d784546c72d5ab1b4f01328a42a00079d0dace487819cd

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://app.chatwoot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Wed, 21 Sep 2022 01:37:00 GMT
content-encoding: gzip
last-modified: Wed, 21 Sep 2022 01:31:48 GMT
server: Cowboy
age: 65867
vary: Accept-Encoding,Origin
strict-transport-security: max-age=63072000; includeSubDomains
content-type: text/css
via: 1.1 vegur, 1.1 75a13c74495137fb5435dc4030981df6.cloudfront.net (CloudFront)
cache-control: public, max-age=31556952
x-cache: Hit from cloudfront
x-amz-cf-pop: FRA60-P1
content-length: 471
x-amz-cf-id: hFP5Nw5VwveWreAHKnMEQpPaQDyNydsVjEOKT2eBzfN0x-JCD7MfqQ==

GET
H2 200 14-72f98a6bd97b0c30c82e.chunk.js Show response
d3tq67kexc2w2i.cloudfront.net/packs/js/ Frame 0446 13 KB
4 KB 38ms
38ms Script
application/javascript 2600:9000:2240:ea00:7:dce7:b680:21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://d3tq67kexc2w2i.cloudfront.net/packs/js/14-72f98a6bd97b0c30c82e.chunk.js

Requested by

Host: d3tq67kexc2w2i.cloudfront.net
URL: https://d3tq67kexc2w2i.cloudfront.net/packs/js/widget-021fd02ded895d1ff570.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2240:ea00:7:dce7:b680:21 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Cowboy /

Resource Hash

7d1838e469bb1d69a5b0da7fced170da646738db8bc45532b09bc81998e27202

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://app.chatwoot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 20 Sep 2022 05:05:22 GMT
content-encoding: gzip
last-modified: Tue, 20 Sep 2022 05:00:19 GMT
server: Cowboy
age: 139766
vary: Accept-Encoding,Origin
strict-transport-security: max-age=63072000; includeSubDomains
content-type: application/javascript
via: 1.1 vegur, 1.1 75a13c74495137fb5435dc4030981df6.cloudfront.net (CloudFront)
cache-control: public, max-age=31556952
x-cache: Hit from cloudfront
x-amz-cf-pop: FRA60-P1
content-length: 4040
x-amz-cf-id: Q-rlsbp0MFXh3kN6g6FyGYEFpLbe9lcoqYriUY5Bzak0JX13ey8geg==

GET
H/1.1 200
OK conversations Show response
app.chatwoot.com/api/v1/widget/ Frame 0446 2 B
646 B 144ms
144ms XHR
application/json 54.237.133.81
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://app.chatwoot.com/api/v1/widget/conversations?website_token=puTnMCiAd9DHeNuoWk2mzm6X

Requested by

Host: d3tq67kexc2w2i.cloudfront.net
URL: https://d3tq67kexc2w2i.cloudfront.net/packs/js/widget-021fd02ded895d1ff570.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

54.237.133.81 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-237-133-81.compute-1.amazonaws.com

Software

Cowboy /

Resource Hash

44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json, text/plain, */*
Referer: https://app.chatwoot.com/widget?website_token=puTnMCiAd9DHeNuoWk2mzm6X
X-Auth-Token: eyJhbGciOiJIUzI1NiJ9.eyJzb3VyY2VfaWQiOiJhZjE3ZTg5My1jZTIyLTRjNTgtYThhMC0yZWRiNTViMjQ2YTAiLCJpbmJveF9pZCI6MTQxMn0.pkm47aLf8Hg6I_i6vpdbNoQ3IdqaA2xAvAk2ANvQBBs
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

Date: Wed, 21 Sep 2022 19:54:47 GMT
Via: 1.1 vegur
X-Content-Type-Options: nosniff
X-Permitted-Cross-Domain-Policies: none
Transfer-Encoding: chunked
Connection: keep-alive
X-Xss-Protection: 1; mode=block
X-Request-Id: 0bbea8d6-9fa9-4761-aa3d-af739529d5da
X-Runtime: 0.013647
Referrer-Policy: strict-origin-when-cross-origin
Server: Cowboy
Etag: W/"44136fa355b3678a1146ad16f7e8649e"
X-Download-Options: noopen
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=63072000; includeSubDomains
Content-Type: application/json; charset=utf-8
Cache-Control: max-age=0, private, must-revalidate

GET
DATA 200
OK truncated
/ 424 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 10bdda367e9ad0ceec3a5577cdf3379cd0c7bea4cdd78aca57fd15f9c8a38ff2

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

Content-Type: image/png

GET
H/1.1 200
OK messages Show response
app.chatwoot.com/api/v1/widget/ Frame 0446 14 B
658 B 282ms
144ms XHR
application/json 54.237.133.81
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://app.chatwoot.com/api/v1/widget/messages?website_token=puTnMCiAd9DHeNuoWk2mzm6X

Requested by

Host: d3tq67kexc2w2i.cloudfront.net
URL: https://d3tq67kexc2w2i.cloudfront.net/packs/js/widget-021fd02ded895d1ff570.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

54.237.133.81 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-237-133-81.compute-1.amazonaws.com

Software

Cowboy /

Resource Hash

258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json, text/plain, */*
Referer: https://app.chatwoot.com/widget?website_token=puTnMCiAd9DHeNuoWk2mzm6X
X-Auth-Token: eyJhbGciOiJIUzI1NiJ9.eyJzb3VyY2VfaWQiOiJhZjE3ZTg5My1jZTIyLTRjNTgtYThhMC0yZWRiNTViMjQ2YTAiLCJpbmJveF9pZCI6MTQxMn0.pkm47aLf8Hg6I_i6vpdbNoQ3IdqaA2xAvAk2ANvQBBs
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

Date: Wed, 21 Sep 2022 19:54:48 GMT
Via: 1.1 vegur
X-Content-Type-Options: nosniff
X-Permitted-Cross-Domain-Policies: none
Transfer-Encoding: chunked
Connection: keep-alive
X-Xss-Protection: 1; mode=block
X-Request-Id: b4058f7d-b672-4f23-a495-07b8f86b3ddb
X-Runtime: 0.014406
Referrer-Policy: strict-origin-when-cross-origin
Server: Cowboy
Etag: W/"258153158e38e3291e3d48162225fcdb"
X-Download-Options: noopen
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=63072000; includeSubDomains
Content-Type: application/json; charset=utf-8
Cache-Control: max-age=0, private, must-revalidate

GET
H/1.1 200
OK inbox_members Show response
app.chatwoot.com/api/v1/widget/ Frame 0446 959 B
2 KB 443ms
183ms XHR
application/json 54.237.133.81
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://app.chatwoot.com/api/v1/widget/inbox_members?website_token=puTnMCiAd9DHeNuoWk2mzm6X

Requested by

Host: d3tq67kexc2w2i.cloudfront.net
URL: https://d3tq67kexc2w2i.cloudfront.net/packs/js/widget-021fd02ded895d1ff570.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

54.237.133.81 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-237-133-81.compute-1.amazonaws.com

Software

Cowboy /

Resource Hash

76f1b39cfb3063a87ebc0b127fdedbf29fe76c5a4c61c9f4cd05eac5c3f5bb9f

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json, text/plain, */*
Referer: https://app.chatwoot.com/widget?website_token=puTnMCiAd9DHeNuoWk2mzm6X
X-Auth-Token: eyJhbGciOiJIUzI1NiJ9.eyJzb3VyY2VfaWQiOiJhZjE3ZTg5My1jZTIyLTRjNTgtYThhMC0yZWRiNTViMjQ2YTAiLCJpbmJveF9pZCI6MTQxMn0.pkm47aLf8Hg6I_i6vpdbNoQ3IdqaA2xAvAk2ANvQBBs
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

Date: Wed, 21 Sep 2022 19:54:49 GMT
Via: 1.1 vegur
X-Content-Type-Options: nosniff
X-Permitted-Cross-Domain-Policies: none
Transfer-Encoding: chunked
Connection: keep-alive
X-Xss-Protection: 1; mode=block
X-Request-Id: 3fcbf59e-a8b7-4190-b7bf-01285f8eb6f1
X-Runtime: 0.048994
Referrer-Policy: strict-origin-when-cross-origin
Server: Cowboy
Etag: W/"76f1b39cfb3063a87ebc0b127fdedbf2"
X-Download-Options: noopen
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=63072000; includeSubDomains
Content-Type: application/json; charset=utf-8
Cache-Control: max-age=0, private, must-revalidate

GET
H/1.1 200
OK contact Show response
app.chatwoot.com/api/v1/widget/ Frame 0446 70 B
715 B 419ms
159ms XHR
application/json 54.237.133.81
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://app.chatwoot.com/api/v1/widget/contact?website_token=puTnMCiAd9DHeNuoWk2mzm6X

Requested by

Host: d3tq67kexc2w2i.cloudfront.net
URL: https://d3tq67kexc2w2i.cloudfront.net/packs/js/widget-021fd02ded895d1ff570.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

54.237.133.81 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-237-133-81.compute-1.amazonaws.com

Software

Cowboy /

Resource Hash

56940c3ec36019fda85c9d892d1eaf64ccc96838b363f9305a7e6d4609b93642

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json, text/plain, */*
Referer: https://app.chatwoot.com/widget?website_token=puTnMCiAd9DHeNuoWk2mzm6X
X-Auth-Token: eyJhbGciOiJIUzI1NiJ9.eyJzb3VyY2VfaWQiOiJhZjE3ZTg5My1jZTIyLTRjNTgtYThhMC0yZWRiNTViMjQ2YTAiLCJpbmJveF9pZCI6MTQxMn0.pkm47aLf8Hg6I_i6vpdbNoQ3IdqaA2xAvAk2ANvQBBs
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

Date: Wed, 21 Sep 2022 19:54:48 GMT
Via: 1.1 vegur
X-Content-Type-Options: nosniff
X-Permitted-Cross-Domain-Policies: none
Transfer-Encoding: chunked
Connection: keep-alive
X-Xss-Protection: 1; mode=block
X-Request-Id: 07139539-7d78-4277-a5d1-7bd48f212c7c
X-Runtime: 0.027974
Referrer-Policy: strict-origin-when-cross-origin
Server: Cowboy
Etag: W/"56940c3ec36019fda85c9d892d1eaf64"
X-Download-Options: noopen
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=63072000; includeSubDomains
Content-Type: application/json; charset=utf-8
Cache-Control: max-age=0, private, must-revalidate

GET
H/1.1 200
OK campaigns Show response
app.chatwoot.com/api/v1/widget/ Frame 0446 2 B
646 B 408ms
154ms XHR
application/json 54.237.133.81
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://app.chatwoot.com/api/v1/widget/campaigns?website_token=puTnMCiAd9DHeNuoWk2mzm6X

Requested by

Host: d3tq67kexc2w2i.cloudfront.net
URL: https://d3tq67kexc2w2i.cloudfront.net/packs/js/widget-021fd02ded895d1ff570.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

54.237.133.81 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-237-133-81.compute-1.amazonaws.com

Software

Cowboy /

Resource Hash

4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json, text/plain, */*
Referer: https://app.chatwoot.com/widget?website_token=puTnMCiAd9DHeNuoWk2mzm6X
X-Auth-Token: eyJhbGciOiJIUzI1NiJ9.eyJzb3VyY2VfaWQiOiJhZjE3ZTg5My1jZTIyLTRjNTgtYThhMC0yZWRiNTViMjQ2YTAiLCJpbmJveF9pZCI6MTQxMn0.pkm47aLf8Hg6I_i6vpdbNoQ3IdqaA2xAvAk2ANvQBBs
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

Date: Wed, 21 Sep 2022 19:54:48 GMT
Via: 1.1 vegur
X-Content-Type-Options: nosniff
X-Permitted-Cross-Domain-Policies: none
Transfer-Encoding: chunked
Connection: keep-alive
X-Xss-Protection: 1; mode=block
X-Request-Id: 5ce27baa-15ce-4d07-8666-5e2880a2c594
X-Runtime: 0.020881
Referrer-Policy: strict-origin-when-cross-origin
Server: Cowboy
Etag: W/"4f53cda18c2baa0c0354bb5f9a3ecbe5"
X-Download-Options: noopen
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=63072000; includeSubDomains
Content-Type: application/json; charset=utf-8
Cache-Control: max-age=0, private, must-revalidate

POST content
ws16.hotjar.com/api/v2/sites/2380708/recordings/ 0
0

POST
H2 200 graphql Show response
mnk2smepzzdp5djxpbthzr6odq.appsync-api.eu-west-1.amazonaws.com/ 26 B
447 B 129ms
129ms XHR
application/json 52.222.236.16
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://mnk2smepzzdp5djxpbthzr6odq.appsync-api.eu-west-1.amazonaws.com/graphql
Requested by: Host: browser.sentry-cdn.com
URL: https://browser.sentry-cdn.com/5.12.1/bundle.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.236.16 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-236-16.fra56.r.cloudfront.net
Software: /
Resource Hash: 6fa6da6f05f56f48f876b2fe7504dc0e89cd6ae5d6874bcc83c85b1e14778a01

Request headers

accept: */*
Referer: https://huntr.dev/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36
x-api-key: da2-fql7xoajcng6pilmew4lfbi6ga
content-type: application/json

Response headers

x-amzn-appsync-tokensconsumed: 1
date: Wed, 21 Sep 2022 19:54:48 GMT
via: 1.1 ce765e91525a836efb6bc0a409334a5e.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P4
x-amzn-requestid: ab2f1011-ac6f-4a2b-8f8c-af4dbf451889
x-cache: Miss from cloudfront
content-type: application/json;charset=UTF-8
access-control-allow-origin: *
access-control-expose-headers: x-amzn-RequestId,x-amzn-ErrorType,x-amz-user-agent,x-amzn-ErrorMessage,Date,x-amz-schema-version
content-length: 26
x-amz-cf-id: AaJ7g99GTtSyvninR65mb-7AUeIkNY_OxZROWyEqK_gvaPEpFOO6Yw==

OPTIONS
H2 200 graphql
mnk2smepzzdp5djxpbthzr6odq.appsync-api.eu-west-1.amazonaws.com/ Frame 0
0 63ms
62ms Preflight 52.222.236.16
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://mnk2smepzzdp5djxpbthzr6odq.appsync-api.eu-west-1.amazonaws.com/graphql
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.236.16 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-236-16.fra56.r.cloudfront.net
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type,x-api-key
Access-Control-Request-Method: POST
Origin: https://huntr.dev
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

access-control-allow-headers: content-type,x-api-key
access-control-allow-methods: POST
access-control-allow-origin: *
access-control-expose-headers: x-amzn-RequestId,x-amzn-ErrorType,x-amz-user-agent,x-amzn-ErrorMessage,Date,x-amz-schema-version
access-control-max-age: 172800
content-length: 0
date: Wed, 21 Sep 2022 19:54:48 GMT
via: 1.1 ce765e91525a836efb6bc0a409334a5e.cloudfront.net (CloudFront)
x-amz-cf-id: xwCR9ys6fDtoAIWlet91YFdkY4KqMsLaeEeT552mijPsTHbeAO6Y2w==
x-amz-cf-pop: FRA56-P4
x-amzn-requestid: fd38bc73-80ff-4992-96af-bf3837a50020
x-cache: Miss from cloudfront

GET
H2 200 5137917
avatars.githubusercontent.com/u/ 33 KB
33 KB 160ms
39ms Image
image/jpeg 2606:50c0:8002::154
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://avatars.githubusercontent.com/u/5137917?v=4

Requested by

Host: huntr.dev
URL: https://huntr.dev/bounties/31ac0506-ae38-4128-a46d-71d5d079f8b7/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:50c0:8002::154 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

80ef91a1ede7c048b2b363283c51e5c56343f0a714e18bf30793a771e8240e94

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'
Strict-Transport-Security	max-age=31557600
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://huntr.dev/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

x-fastly-request-id: b7bd2bea60819307efc8e9ff65aaa62c58ac1d95
content-security-policy: default-src 'none'
via: 1.1 varnish
x-content-type-options: nosniff
x-cache: HIT
x-cache-hits: 1
vary: Authorization,Accept-Encoding
content-length: 33706
x-xss-protection: 1; mode=block
x-served-by: cache-hhn4023-HHN
last-modified: Thu, 01 Jul 2021 15:08:40 GMT
x-github-request-id: 0805:220B:1F1E29:2203E9:632A449B
x-timer: S1663790089.936524,VS0,VE1
x-frame-options: deny
date: Wed, 21 Sep 2022 19:54:48 GMT
source-age: 75629
strict-transport-security: max-age=31557600
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=300
etag: "85c4ba66cbcf1e261e397613ea138a1fffb19a62baf5a5ccf1668ecfbb6f0c84"
accept-ranges: bytes
timing-allow-origin: https://github.com
expires: Wed, 21 Sep 2022 19:59:48 GMT

GET
H2 200 4806a0f.js Show response
huntr.dev/_nuxt/ 56 KB
16 KB 155ms
155ms Script
application/javascript 2600:9000:214f:9c00:14:bb32:5f00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://huntr.dev/_nuxt/4806a0f.js

Requested by

Host: huntr.dev
URL: https://huntr.dev/_nuxt/2c71194.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:214f:9c00:14:bb32:5f00:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

b1ca854fdcbbd22814f0b780910cadf03c63f6b86eddaca6e72aa3568c4988fd

Security Headers

Name	Value
Content-Security-Policy	style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://heapanalytics.com; connect-src 'self' https://cdn.segment.com https://.ingest.sentry.io https://.hotjar.com https://.hotjar.io https://.huntr.dev https://.appsync-api.eu-west-1.amazonaws.com https://api.github.com https://api.bloggify.net https://heapanalytics.com https://api.segment.io wss://.hotjar.com https://app.posthog.com https://app.chatwoot.com; script-src 'self' 'unsafe-inline' https://browser.sentry-cdn.com https://cdn.heapanalytics.com https://heapanalytics.com https://*.hotjar.com https://app.chatwoot.com https://cdn.segment.com; font-src 'self' data: https://fonts.gstatic.com; child-src blob: https://www.youtube.com https://app.chatwoot.com https://vars.hotjar.com https://www.podbean.com;
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://huntr.dev/bounties/31ac0506-ae38-4128-a46d-71d5d079f8b7/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Wed, 21 Sep 2022 19:54:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-amz-cf-pop: FRA53-C1
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
vary: Accept-Encoding
x-xss-protection: 1; mode=block
last-modified: Tue, 13 Sep 2022 20:42:30 GMT
server: AmazonS3
x-frame-options: SAMEORIGIN
etag: W/"0eab1fdbc9de4b9da2107683c400703b"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript
via: 1.1 a4a46c5a6cdf81ec1d08cf6e63389764.cloudfront.net (CloudFront)
cache-control: public, max-age=0, s-maxage=600
content-security-policy: style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://heapanalytics.com; connect-src 'self' https://cdn.segment.com https://*.ingest.sentry.io https://*.hotjar.com https://*.hotjar.io https://*.huntr.dev https://*.appsync-api.eu-west-1.amazonaws.com https://api.github.com https://api.bloggify.net https://heapanalytics.com https://api.segment.io wss://*.hotjar.com https://app.posthog.com https://app.chatwoot.com; script-src 'self' 'unsafe-inline' https://browser.sentry-cdn.com https://cdn.heapanalytics.com https://heapanalytics.com https://*.hotjar.com https://app.chatwoot.com https://cdn.segment.com; font-src 'self' data: https://fonts.gstatic.com; child-src blob: https://www.youtube.com https://app.chatwoot.com https://vars.hotjar.com https://www.podbean.com;
x-amz-cf-id: 0d0AvtkGp47MB1dump_4PKerrqcOJY125MK9-M1UtjK69Ck1nEHGEQ==

GET
H2 200 41514973
avatars.githubusercontent.com/u/ 16 KB
16 KB 40ms
40ms Image
image/jpeg 2606:50c0:8002::154
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://avatars.githubusercontent.com/u/41514973?v=4

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:50c0:8002::154 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

e2f635dc4f2820dc5a30540e8658599a0083d4ec1c3ffdc2258941f03b4cb429

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'
Strict-Transport-Security	max-age=31557600
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://huntr.dev/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

x-fastly-request-id: 9fa15ee4078c6018bc3faeb32e504cefad824cf8
content-security-policy: default-src 'none'
via: 1.1 varnish
x-content-type-options: nosniff
x-cache: HIT
x-cache-hits: 1
vary: Authorization,Accept-Encoding
content-length: 16405
x-xss-protection: 1; mode=block
x-served-by: cache-hhn4023-HHN
last-modified: Wed, 09 Oct 2019 04:34:32 GMT
x-github-request-id: 7A32:4664:4E2CF8:529F12:63223745
x-timer: S1663790089.015369,VS0,VE1
x-frame-options: deny
date: Wed, 21 Sep 2022 19:54:49 GMT
source-age: 603332
strict-transport-security: max-age=31557600
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=300
etag: "24661d2434a81559881ebf00223ed12a31d781c18be22e328a6cee6f3939682b"
accept-ranges: bytes
timing-allow-origin: https://github.com
expires: Wed, 21 Sep 2022 19:59:49 GMT

GET
H2

200

686745
avatars.githubusercontent.com/u/
Redirect Chain

https://github.com/pimcore.png
https://avatars.githubusercontent.com/u/686745?v=4

8 KB
8 KB

40ms
39ms

Image
image/png

2606:50c0:8002::154
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://avatars.githubusercontent.com/u/686745?v=4

Protocol

Server

2606:50c0:8002::154 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

b85decab5bf417d06f23cbaaed908151e55c63d5463f75c88b19b2d92a6a7c7a

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'
Strict-Transport-Security	max-age=31557600
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://huntr.dev/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

x-fastly-request-id: ad40de6eda71f55fdd05f889ffaae74e16cb490d
content-security-policy: default-src 'none'
via: 1.1 varnish
x-content-type-options: nosniff
x-cache: HIT
x-cache-hits: 1
vary: Authorization,Accept-Encoding
content-length: 7793
x-xss-protection: 1; mode=block
x-served-by: cache-hhn4023-HHN
last-modified: Mon, 19 Feb 2018 12:24:55 GMT
x-github-request-id: 0806:8581:56623E:5B9898:631FBD1C
x-timer: S1663790089.287768,VS0,VE1
x-frame-options: deny
date: Wed, 21 Sep 2022 19:54:49 GMT
source-age: 765677
strict-transport-security: max-age=31557600
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=300
etag: "b526e590a2edd6a1857b8ea7ca935d5286d30e9d732a172a2347149313d137a2"
accept-ranges: bytes
timing-allow-origin: https://github.com
expires: Wed, 21 Sep 2022 19:59:49 GMT

Redirect headers

date: Wed, 21 Sep 2022 19:54:49 GMT
referrer-policy: origin-when-cross-origin, strict-origin-when-cross-origin
server: GitHub.com
x-github-request-id: C9E4:1C34:400DCE8:41A56CD:632B6C09
x-frame-options: deny
expect-ct: max-age=2592000, report-uri="https://api.github.com/_private/browser/errors"
vary: X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, Accept-Encoding, Accept, X-Requested-With
content-type: text/html; charset=utf-8
location: https://avatars.githubusercontent.com/u/686745?v=4
cache-control: no-cache
x-content-type-options: nosniff
content-security-policy: default-src 'none'; base-uri 'self'; block-all-mixed-content; child-src github.com/assets-cdn/worker/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com objects-origin.githubusercontent.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com cdn.optimizely.com logx.optimizely.com/v1/events *.actions.githubusercontent.com wss://*.actions.githubusercontent.com online.visualstudio.com/api/v1/locations github-production-repository-image-32fea6.s3.amazonaws.com github-production-release-asset-2e65be.s3.amazonaws.com insights.github.com wss://alive.github.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com objects-origin.githubusercontent.com; frame-ancestors 'none'; frame-src render.githubusercontent.com viewscreen.githubusercontent.com notebooks.githubusercontent.com; img-src 'self' data: github.githubassets.com identicons.github.com github-cloud.s3.amazonaws.com secured-user-images.githubusercontent.com/ github-production-user-asset-6210df.s3.amazonaws.com customer-stories-feed.github.com spotlights-feed.github.com *.githubusercontent.com; manifest-src 'self'; media-src github.com user-images.githubusercontent.com/ secured-user-images.githubusercontent.com/; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; worker-src github.com/assets-cdn/worker/ gist.github.com/assets-cdn/worker/
strict-transport-security: max-age=31536000; includeSubdomains; preload
content-length: 0
x-xss-protection: 0

GET
H/1.1

200
OK

57496d59bd65461658f8699a5f17b76e76ea0b02ffb71890c8dbfe4064ba7e6e
prod-chatwoot-assets.s3.amazonaws.com/variants/2ll67w41cg1ugvvjj7lvmhtlw499/ Frame 0446
Redirect Chain

https://app.chatwoot.com/rails/active_storage/representations/redirect/eyJfcmFpbHMiOnsibWVzc2FnZSI6IkJBaHBBeWplRVE9PSIsImV4cCI6bnVsbCwicHVyIjoiYmxvYl9pZCJ9fQ==--6cb91ac7b4e48808e78a8d6ff61c52a99da0...
https://prod-chatwoot-assets.s3.amazonaws.com/variants/2ll67w41cg1ugvvjj7lvmhtlw499/57496d59bd65461658f8699a5f17b76e76ea0b02ffb71890c8dbfe4064ba7e6e?response-content-disposition=inline%3B%20filenam...

18 KB
19 KB

450ms
166ms

Image
image/png

54.231.204.161
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prod-chatwoot-assets.s3.amazonaws.com/variants/2ll67w41cg1ugvvjj7lvmhtlw499/57496d59bd65461658f8699a5f17b76e76ea0b02ffb71890c8dbfe4064ba7e6e?response-content-disposition=inline%3B%20filename%3D%22New%20Project%20%252816%2529.png%22%3B%20filename%2A%3DUTF-8%27%27New%2520Project%2520%252816%2529.png&response-content-type=image%2Fpng&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAX7PDOLKIEKWPSDFO%2F20220921%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20220921T195449Z&X-Amz-Expires=300&X-Amz-SignedHeaders=host&X-Amz-Signature=200911c225e773d72a99431993718344fd4024b18d66bd251926a63616b22cc0
Protocol: HTTP/1.1
Server: 54.231.204.161 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1-w.amazonaws.com
Software: AmazonS3 /
Resource Hash: e17900682004a70680ef07bcf114ef26e6cb94853892133a869e89e110b40a53

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://app.chatwoot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

x-amz-server-side-encryption: AES256
Date: Wed, 21 Sep 2022 19:54:50 GMT
Last-Modified: Wed, 30 Mar 2022 16:04:43 GMT
Server: AmazonS3
x-amz-request-id: RYTT5EWY3DS3W98F
ETag: "46905dbd95a052f59e14b7dec8b50a6a"
Content-Type: image/png
Content-Disposition: inline; filename="New Project %2816%29.png"; filename*=UTF-8''New%20Project%20%2816%29.png
Accept-Ranges: bytes
Content-Length: 18903
x-amz-id-2: AqbXe3vnPfJ8k3FvOOXRzYp9TftiR3tEc45M87KyceRETRjyNIxCj5n8YncxRHNW2ATTlBTIcOA=

Redirect headers

Date: Wed, 21 Sep 2022 19:54:49 GMT
Via: 1.1 vegur
X-Content-Type-Options: nosniff
X-Permitted-Cross-Domain-Policies: none
Transfer-Encoding: chunked
Connection: keep-alive
X-Xss-Protection: 1; mode=block
X-Request-Id: 94e05264-742e-4cd6-b7e6-ff90e9765457
X-Runtime: 0.044148
Referrer-Policy: strict-origin-when-cross-origin
Server: Cowboy
X-Download-Options: noopen
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=63072000; includeSubDomains
Content-Type: text/html; charset=utf-8
Location: https://prod-chatwoot-assets.s3.amazonaws.com/variants/2ll67w41cg1ugvvjj7lvmhtlw499/57496d59bd65461658f8699a5f17b76e76ea0b02ffb71890c8dbfe4064ba7e6e?response-content-disposition=inline%3B%20filename%3D%22New%20Project%20%252816%2529.png%22%3B%20filename%2A%3DUTF-8%27%27New%2520Project%2520%252816%2529.png&response-content-type=image%2Fpng&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAX7PDOLKIEKWPSDFO%2F20220921%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20220921T195449Z&X-Amz-Expires=300&X-Amz-SignedHeaders=host&X-Amz-Signature=200911c225e773d72a99431993718344fd4024b18d66bd251926a63616b22cc0
Cache-Control: max-age=300, private

GET
H/1.1 200
OK logo_thumbnail.svg
app.chatwoot.com/brand-assets/ Frame 0446 916 B
1 KB 131ms
131ms Image
image/svg+xml 54.237.133.81
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://app.chatwoot.com/brand-assets/logo_thumbnail.svg

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

54.237.133.81 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-237-133-81.compute-1.amazonaws.com

Software

Cowboy /

Resource Hash

9c1bb7bba73eaf75e949795556bc7e66ce7ff3fec6f65797271c7cfe1a305f6f

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://app.chatwoot.com/widget?website_token=puTnMCiAd9DHeNuoWk2mzm6X
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

Date: Wed, 21 Sep 2022 19:54:48 GMT
Via: 1.1 vegur
Last-Modified: Wed, 21 Sep 2022 01:23:28 GMT
Server: Cowboy
Strict-Transport-Security: max-age=63072000; includeSubDomains
Content-Type: image/svg+xml
Cache-Control: public, max-age=31556952
Connection: keep-alive
Content-Length: 916

POST
H2 200 graphql Show response
mnk2smepzzdp5djxpbthzr6odq.appsync-api.eu-west-1.amazonaws.com/ 26 B
446 B 88ms
88ms XHR
application/json 52.222.236.16
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://mnk2smepzzdp5djxpbthzr6odq.appsync-api.eu-west-1.amazonaws.com/graphql
Requested by: Host: browser.sentry-cdn.com
URL: https://browser.sentry-cdn.com/5.12.1/bundle.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.236.16 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-236-16.fra56.r.cloudfront.net
Software: /
Resource Hash: 6fa6da6f05f56f48f876b2fe7504dc0e89cd6ae5d6874bcc83c85b1e14778a01

Request headers

accept: */*
Referer: https://huntr.dev/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36
x-api-key: da2-fql7xoajcng6pilmew4lfbi6ga
content-type: application/json

Response headers

x-amzn-appsync-tokensconsumed: 1
date: Wed, 21 Sep 2022 19:54:49 GMT
via: 1.1 ce765e91525a836efb6bc0a409334a5e.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P4
x-amzn-requestid: 1990ff4e-d63b-40c4-8fec-91e589fe69fe
x-cache: Miss from cloudfront
content-type: application/json;charset=UTF-8
access-control-allow-origin: *
access-control-expose-headers: x-amzn-RequestId,x-amzn-ErrorType,x-amz-user-agent,x-amzn-ErrorMessage,Date,x-amz-schema-version
content-length: 26
x-amz-cf-id: agA01yz6MHFP4NgxQEVBeDOrfnzyV5cmXQvR4C377sjBd4ZGe1QRzQ==

OPTIONS
H2 200 graphql
mnk2smepzzdp5djxpbthzr6odq.appsync-api.eu-west-1.amazonaws.com/ Frame 0
0 61ms
61ms Preflight 52.222.236.16
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://mnk2smepzzdp5djxpbthzr6odq.appsync-api.eu-west-1.amazonaws.com/graphql
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.236.16 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-236-16.fra56.r.cloudfront.net
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type,x-api-key
Access-Control-Request-Method: POST
Origin: https://huntr.dev
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

access-control-allow-headers: content-type,x-api-key
access-control-allow-methods: POST
access-control-allow-origin: *
access-control-expose-headers: x-amzn-RequestId,x-amzn-ErrorType,x-amz-user-agent,x-amzn-ErrorMessage,Date,x-amz-schema-version
access-control-max-age: 172800
content-length: 0
date: Wed, 21 Sep 2022 19:54:49 GMT
via: 1.1 ce765e91525a836efb6bc0a409334a5e.cloudfront.net (CloudFront)
x-amz-cf-id: LxyEXJDEHFJbfJXQL_wMwhP6xLpy6i0sB2ZcnVaEVa5-h6IpaVREIA==
x-amz-cf-pop: FRA56-P4
x-amzn-requestid: 609a59f3-9b7d-44fc-bc47-e98cd1e09e29
x-cache: Miss from cloudfront

POST
H2 200 / Show response
app.posthog.com/e/ 13 B
293 B 141ms
140ms XHR
application/json 3.214.195.105
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://app.posthog.com/e/?compression=gzip-js&ip=1&_=1663790090136

Requested by

Host: browser.sentry-cdn.com
URL: https://browser.sentry-cdn.com/5.12.1/bundle.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.214.195.105 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-214-195-105.compute-1.amazonaws.com

Software

Resource Hash

7d4afed20a912db310862a5294bcf8fb6269c76a292908ddc1fbd496456eff56

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://huntr.dev/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36
Content-Type: text/plain

Response headers

date: Wed, 21 Sep 2022 19:54:50 GMT
referrer-policy: same-origin
x-frame-options: DENY
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/json
access-control-allow-origin: https://huntr.dev
access-control-allow-credentials: true
access-control-allow-headers: X-Requested-With,Content-Type
content-length: 13
x-content-type-options: nosniff

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: ws16.hotjar.com
URL: https://ws16.hotjar.com/api/v2/sites/2380708/recordings/content

Verdicts & Comments Add Verdict or Comment

66 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

9 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
huntr.dev/	1969-12-31 23:59:59	Name: auth.strategy Value: cognito
.huntr.dev/	1970-01-20 14:55:26	Name: ph_phc_GS5LnADH5vBtmEMYnjEZbSH4DVSNMemzgYiuyGyUZz9_posthog Value: %7B%22distinct_id%22%3A%22183619dfbd8395-0689503d41846e-6b3f5152-1d4c00-183619dfbd9fbe%22%2C%22%24device_id%22%3A%22183619dfbd8395-0689503d41846e-6b3f5152-1d4c00-183619dfbd9fbe%22%2C%22%24initial_referrer%22%3A%22%24direct%22%2C%22%24initial_referring_domain%22%3A%22%24direct%22%2C%22%24referrer%22%3A%22%24direct%22%2C%22%24referring_domain%22%3A%22%24direct%22%2C%22%24sesid%22%3A%5B1663790087138%2C%22183619dfbe265a-0361055947f561-6b3f5152-1d4c00-183619dfbe3a4d%22%5D%2C%22%24session_recording_enabled%22%3Afalse%2C%22%24active_feature_flags%22%3A%5B%5D%2C%22%24enabled_feature_flags%22%3A%7B%7D%7D
.huntr.dev/	1970-01-20 14:55:26	Name: ajs_anonymous_id Value: ae9bf371-ba12-4e66-a878-647bff2c200a
.huntr.dev/	1970-01-20 14:55:26	Name: _hjSessionUser_2380708 Value: eyJpZCI6IjYxZDM2Mjc0LTkyNzEtNThlMy1iODMxLTY3ZmY2NzZiNTc1NyIsImNyZWF0ZWQiOjE2NjM3OTAwODg1NjQsImV4aXN0aW5nIjpmYWxzZX0=
.huntr.dev/	1970-01-20 06:09:51	Name: _hjFirstSeen Value: 1
huntr.dev/	1970-01-20 06:09:50	Name: _hjIncludedInSessionSample Value: 1
.huntr.dev/	1970-01-20 06:09:51	Name: _hjSession_2380708 Value: eyJpZCI6IjFjYmYxMWMxLWJlM2UtNGQ4Ni04MjZiLTg2MDhhMDA1Njc1ZiIsImNyZWF0ZWQiOjE2NjM3OTAwODg1OTAsImluU2FtcGxlIjp0cnVlfQ==
.huntr.dev/	1970-01-20 06:09:51	Name: _hjAbsoluteSessionInProgress Value: 0
huntr.dev/	1970-01-20 14:55:26	Name: cw_conversation Value: eyJhbGciOiJIUzI1NiJ9.eyJzb3VyY2VfaWQiOiJhZjE3ZTg5My1jZTIyLTRjNTgtYThhMC0yZWRiNTViMjQ2YTAiLCJpbmJveF9pZCI6MTQxMn0.pkm47aLf8Hg6I_i6vpdbNoQ3IdqaA2xAvAk2ANvQBBs

4 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://huntr.dev/bounties/31ac0506-ae38-4128-a46d-71d5d079f8b7/ Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://script.hotjar.com/modules.f4179535429bf14e77ee.js(Line 1) Message: WebSocket connection to 'wss://ws16.hotjar.com/api/v2/client/ws' failed: Error during WebSocket handshake: Unexpected response code: 503
javascript	error	URL: https://huntr.dev/bounties/31ac0506-ae38-4128-a46d-71d5d079f8b7/ Message: Access to XMLHttpRequest at 'https://ws16.hotjar.com/api/v2/sites/2380708/recordings/content' from origin 'https://huntr.dev' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://ws16.hotjar.com/api/v2/sites/2380708/recordings/content Message: Failed to load resource: net::ERR_FAILED

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

api.segment.io
app.chatwoot.com
app.posthog.com
avatars.githubusercontent.com
browser.sentry-cdn.com
cdn.segment.com
d3tq67kexc2w2i.cloudfront.net
github.com
huntr.dev
in.hotjar.com
lh3.googleusercontent.com
mnk2smepzzdp5djxpbthzr6odq.appsync-api.eu-west-1.amazonaws.com
prod-chatwoot-assets.s3.amazonaws.com
script.hotjar.com
static.hotjar.com
vars.hotjar.com
ws16.hotjar.com
ws16.hotjar.com
13.225.79.112
140.82.121.3
18.66.97.53
2600:9000:214f:9c00:14:bb32:5f00:93a1
2600:9000:2240:ea00:7:dce7:b680:21
2606:50c0:8002::154
2a00:1450:4001:800::2001
2a04:4e42:200::729
3.214.195.105
52.11.123.128
52.222.236.16
52.222.236.43
52.30.157.40
54.231.204.161
54.237.133.81
65.9.44.23
05cee74e08992e6f58bc28d43ff042c5def119ba66ca7601cdb4b3efce53625f
077cdab15161232a9ba7124d2ddd7a9425145750788e9a966c156cc66274f525
08a0dadd9f2fd9d9aea51b8c07c2d84f2c98d86880c99fe0e8bea14fe0483fce
0916dd4cdded5f7f2bc077d4cd5cf4704c0e9972a891aadf5359bf8e62c493d3
0c6cece955685c5ff23f4c7ffef013bef3313e5bd3b7938f8acc49e49e5dbcbd
10bdda367e9ad0ceec3a5577cdf3379cd0c7bea4cdd78aca57fd15f9c8a38ff2
12f71cb993958eefc4bdb41d7dbbda490779a9c7aba448f7be52bb63912e0254
1364fc71ab196d3eb6c9e1bb8c7ff592a0d225efc92e21caa21d96e79931448b
1a37031e6a0feef007ad05ef938452805b8c01fd6a3e3388e62a951c65796df7
1d589d1cfd1183c8d6cbc70d793d500f325a4e114b7362d9f7db65e090a120c7
22c9554b30b2d88619261c7ea4ed2c95db567cf3be83f5ea2cbb2087043e2c7b
258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57
30911cb2d9e297e499d784546c72d5ab1b4f01328a42a00079d0dace487819cd
373059db7c24b296fc0a96692d7eecb9249d4274128de91c553bc70467c7d8ce
38d343434c38de27774371d949ef2d53cf0ffb068c8ffe315fdec978ca6e1de4
421f26b23e2be6b98373d32acd3cb2897b154d4bf0a77d26534ce476e4cbed53
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
46354f041f1d15b2ef3ae63228cb7116fa498f180ea9e49e442f1a561aedf7d2
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
5367a9ddcb66dcf346be2c8eaaefb73ab205869e8d1224967603eb6e28cf6a42
54502058e97eaac693950652b3243bf71346305b1b3c5a2fa479c27dd8d5a73f
56940c3ec36019fda85c9d892d1eaf64ccc96838b363f9305a7e6d4609b93642
56adfe951f03977fd032e10949aa48014ea7e01057d364b5af625c4d27e2a14d
56e3d9843ca444fd15ada7abb636eac771a4f1c88442215598042a2172eb2a64
576cfcae3e1ad3dd2bde162d6917c03842baf18a65ca68f1b42698a52a303539
5c967a3fbb481cac18f919f1015901f05276a976bb4f22e65b492f16e54631ad
6d099709adf0af21feb9ca7343511e99bab076ca5d1f4d92b7be276f81f3f029
6f8992eb58eeced41efea7076be4d468ac678f9778420438fab4a3358aa2b462
6fa6da6f05f56f48f876b2fe7504dc0e89cd6ae5d6874bcc83c85b1e14778a01
740720449f552eee79a5599ce23d81cf4d0ba7d9f71941c65903fe21b82e1e0e
752691a5f3544604fa4e0c630d7bd1dd4077bc34d94ed60b1e17ca2c89f9d084
75457b054e6e1e89f10dda4b777d5676404acaa1541618f03d4ed055a3857e05
76f1b39cfb3063a87ebc0b127fdedbf29fe76c5a4c61c9f4cd05eac5c3f5bb9f
78420a011bbebafa356ef0a6d45fee785af8cc117f1c118953efe652edd4066c
78a22e968841df97d2a8f5f6150f98a563a711e6d4097962719837c18320f3b1
78ee838ac4fcfc7978efd6ef8dff5bd0cbf96fba76b9c3e3a905ce4273d87bd4
7d1838e469bb1d69a5b0da7fced170da646738db8bc45532b09bc81998e27202
7d4afed20a912db310862a5294bcf8fb6269c76a292908ddc1fbd496456eff56
7e7056490a6aa47842422c016c7990d2621f7efb96114ba073809ca7ef306489
80c5641568702dee9452648cad502cea5339a5764e95c1edde62793b4802b241
80ef91a1ede7c048b2b363283c51e5c56343f0a714e18bf30793a771e8240e94
85fa85cbca5efaa81351f2e9b1e8e53916644bff91da6ffc762a151247501ebc
867b23a408fa99143955de5665345cda886857174c328d2828e5dcd33bd98cd1
87aa89bced2db81255e5bffd86f653b840cb266cd52d0508b43a6e7fb373987f
89060a5aaf5b8d9b7eb3e5fb336cbae933294420f7f4983eae7c916f395cf304
8c3baaff57a8d024482677afa23e73c21112b96e424fb538a569fc9928ea106c
917a1a36e4df34776ab68224439190e342ac6cb9b3697d51606a6b8c7d9271f6
93a1f3263e3c883f998ff8f4a3fd8afc3066f33daf90248b89e2bb01cd2003f7
9a279a8cfe3eb891b1a7a5458606ae20be74304c60e05b985f3bea0f6815e96b
9abdea148f6bb2fd5f4d3a947661b46f077584cfc3691deb29fa7cb25d2e00a6
9c1bb7bba73eaf75e949795556bc7e66ce7ff3fec6f65797271c7cfe1a305f6f
9c2e90e9aa0e8b34580a9b8d1e015b006983148d3631faedd8c8b0f839f8ada7
9de1041297927941b9c0d2104c967e3a17544dc79c5c9d49d3500af6397a9f7f
9f499f6acd4ca570e294eac05c837b263638f678d71f4ec5a57c744a5f5b95df
a07884d0d9d5d56f50513c2aea835403cf50d7d9cb013883f80424daf7ef3701
a2d3f0a59da3ade1b5ba72f112bd793ff7d874ad9450bebd3c2f4f8703474ebb
a52ff266a8e0b61ef8f778ee06bd7342ade91db379a0dda95d687e7e1d508c55
a6a28dc168304608065bebf2920b473ceda58ce5e249087e4cfd00e37069617c
ab513161359bcd805d8df2ae160b0064edcdc60f914ac3f0bac697f2979bfd1e
af8ab56dd2f180b6a916aa1c0775bed78d84c2d522300f0cf422e57552024960
b17b4a5cc840a366a4c006794502f887a316402f781f85e913ac4af19a93fc13
b1ca854fdcbbd22814f0b780910cadf03c63f6b86eddaca6e72aa3568c4988fd
b49647ca17935cfd8f4b81ace833d4ac41bed83aefa112a5f5e06dec1755f8ab
b85decab5bf417d06f23cbaaed908151e55c63d5463f75c88b19b2d92a6a7c7a
bb918e4772434c8678a69a4d9c1683e0ccf4bc2498f5240d1465b8287d2387cb
bffad81246e13f89b8aff1aa4415ff0cd6d7ec01aec2a19e740a48e64fd5cf1b
c15d07f9d87fea851ff9306ff597b442e7ca8f6b306acaf6fe753ed259decee4
c278fc2756f7d4a5d166505c54e0a6d7d825a969bd241e6454b60afdefe500e0
cc5636ad148856af68c9939793223315481995597a8ed13b903367ff59973f80
d08741c1171a2f3fc784af466ef82071a611b1b30092b78b2ac23d575ba2b345
e17900682004a70680ef07bcf114ef26e6cb94853892133a869e89e110b40a53
e2f635dc4f2820dc5a30540e8658599a0083d4ec1c3ffdc2258941f03b4cb429
e82c376465bde839192944cece9d23d0c39d2ddb7523212b4a809355f15efb59
e8771b238c60c36fc935fd2dad0aed6e70cea50a635ff4f89f394a968a258c42
edf1cbc0c73bcd75aab90b3795941f0e7e30efab1f2758065b057253e54e948c
f01cfc989119bf358354bd3789ec028284e9f9be6b5edcfd73fc3f5603e1c942
f4982eb597ebc7e4f986223cfadd738dcb6c1c10b075d2b73e46e5c152f406d9
f4e461a88507fc83bc4732d7cec7b9e28b3f44e8ee5e25de73d4a877dcf58c79
f5ab0d45edae2aadc349fbaf547da2dd376e68c70edab2f778cfcbedd6b6b54c
fe53a0e8f9c1c6c61aee80e0605b431396992f57cc205d3f79eeff76dd2dbbb7

huntr.dev Open in urlscan Pro 2600:9000:214f:9c00:14:bb32:5f00:93a1 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

89 Requests

97 %HTTPS

31 %IPv6

12 Domains

17 Subdomains

16 IPs

3 Countries

2039 kBTransfer

5883 kBSize

9 Cookies

16 Outgoing links

Page URL History

Redirected requests

89 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

huntr.dev Open in urlscan Pro
2600:9000:214f:9c00:14:bb32:5f00:93a1 Public Scan

Screenshot
Live screenshot

Full Image

89
Requests

97 %
HTTPS

31 %
IPv6

12
Domains

17
Subdomains

16
IPs

3
Countries

2039 kB
Transfer

5883 kB
Size

9
Cookies

89 HTTP transactions
1 data transactions